Method for copy protection

ABSTRACT

A method for copy protection in which an audiovisual or audio data is divided into a plurality of portions. The plurality of portions is at least partly scrambled and prepared so as to be stored on a record carrier in the scrambled order. This is done so that a physical position on the record carrier, e.g., a sector of the record carrier, where a respective portions of the divided data is stored depends on the scrambled order.

Embodiments of the invention relate to methods, devices and systems forcopy protection as well as to copy protected record carriers.

BACKGROUND

Various methods and algorithms for copy protecting content stored on arecord carrier exist. Content that may be protected by such copyprotection methods may e.g. be data such as computer programs,audiovisual content such as e.g. movies, and audio content in audiofiles.

However, many of the available methods and algorithms for copyprotection have been “hacked”, i.e. the copy protection may be removedfrom the record carrier and the content be distributed on recordableoptical data carrier or as “ripped” versions stored on hard disks orother storages.

Thus, there is a constant need to improve the quality of copy protectionmethods and algorithms.

BRIEF SUMMARY

It is an object of embodiments of the invention to provide methods,devices and systems for copy protection. It is a further object of theinvention to provide a copy protected record carrier.

These objects are solved by the independent claims.

Further details of the invention will become apparent from aconsideration of the drawings and ensuing description.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The accompanying drawings are included to provide a furtherunderstanding of embodiments and are incorporated in and constitute apart of this specification. The drawings illustrate embodiments andtogether with the description serve to explain principles ofembodiments. Other embodiments and many of the intended advantages ofembodiments will be readily appreciated as they become better understoodby reference to the following detailed description. The elements of thedrawings are not necessarily to scale relative to each other. Likereference numerals designate corresponding similar portions.

FIG. 1 shows an embodiment where an audiovisual file is divided into aplurality portions and the portions are stored in a plurality of fileson a record carrier.

FIG. 2 shows an embodiment where the record carrier is a Blu-ray (BD)disc and playlists are used to playback audiovisual content stored onthe disc.

FIGS. 3A to 3C show a further embodiment where audiovisual files (clips)are divided and stored on the record carrier in a scrambled order.

FIGS. 4A to 4B show a possibility of hiding a correct playlist bycreating fake playlists.

FIG. 5A shows how playback of an original (pre-recorded) record carrierworks.

FIG. 5B shows an embodiment with additional (fake) titles.

FIGS. 6A to 6C show an embodiment where additional files are included onthe record carrier.

FIGS. 7A to 7D show a further embodiment where advertising or chunkclips are inserted in fake playlists.

FIG. 8 shows an embodiment where the feature of multiple viewing anglesof the Blu-ray standard is applied.

FIG. 9 shows an embodiment where a playlist is provided from a server.

FIG. 10A shows an embodiment where watermarked audiovisual files areincluded in playlists.

FIG. 10B shows a further embodiment where watermarked audiovisual filesare included in playlists.

FIG. 11 shows a further embodiment for illustrating the use ofwatermarked audiovisual files.

FIG. 12 shows an embodiment where playback is prevented or playback isdone with reduced entertainment value in case a copy is detected.

FIG. 13 shows what may happen when playback is started from a copy.

FIG. 14 shows what may happen when playback is done from a hard disk,i.e. an attempt is made to playback ripped content.

FIG. 15 shows a diagram for explaining an embodiment of an original diskcheck.

FIG. 16 shows a diagram for explaining a further embodiment of anoriginal disk check.

FIG. 17 shows an embodiment where within program instructions stored ona Blu-ray disk, a volume ID and/or PMSN is verified.

FIG. 18 shows an embodiment where a native module is installed on a hostenvironment.

FIG. 19A shows a further embodiment where bytes are read at certainpositions.

FIG. 19B shows steps of a method for copy protection according to afurther embodiment.

FIG. 19C-1 shows an embodiment where the control flow of the programinstructions on a record carrier is modified depending on bytes read atcertain positions.

FIG. 19C-2 shows a further embodiment where the control flow of theprogram instructions on a record carrier is modified depending on bytesread at certain positions, wherein depending on a selected program pathdifferent playlists are selected for playback.

FIG. 19D shows a further embodiment where bytes are read at certainpositions, the bytes being interpreted as key material.

FIG. 19E shows a further embodiment where bytes are read at certainpositions, the bytes being interpreted as a Java Class File.

FIG. 19F shows a further embodiment where bytes are read at certainpositions, the bytes being interpreted as a playlist file.

FIG. 19G shows steps of a method where bytes read at certain positionsare interpreted as playlist file and included in a file system of aBlu-ray disc by a VFS update command.

FIG. 19H shows steps of a method where bytes read at certain positionsare interpreted as playlist file and included in a file system of aBlu-ray disc by a VFS update command, thereby replacing a playlist filestored on the disc.

FIG. 19I shows a further embodiment where bytes are read at certainpositions, the bytes being interpreted as Unit_Key_RO.inf file.

FIG. 19J shows a further embodiment with a Blu-ray disc, wherein theUnit_Key_RO.inf file comprises at least some corrupted data.

FIG. 20 shows steps that may e.g. be part of a mastering process for aBlu-ray disc.

FIG. 21 shows an embodiment where copy protection is realized bygenerating different video sequences for different portions of a genuineaudiovisual file.

FIG. 22 shows an example for a BD playlist with a main and a subpath.

FIG. 23A shows an embodiment with fake playlists based on playlists withvarying sub-paths.

FIG. 23B shows the result when using the playlists of FIG. 23A forplayback.

FIG. 23C shows an embodiment with fake playlists based on playlists witha plurality of sub-paths.

FIG. 24A shows an embodiment where junk content is inserted into a mainmovie.

FIG. 24B shows an embodiment where junk data or a missing portion isprovided from a server and included into a main movie as a subpath.

FIG. 25 shows an embodiment of a record carrier where certain sectionsare referenced by different logical file names.

FIG. 26 shows the logical file system of FIG. 25.

FIG. 27 shows an example of how a copy program might copy the recordcarrier of FIGS. 25 and 26.

FIG. 28 shows an embodiment with arbitrary shuffled logical file names.

FIG. 29 shows an embodiment where fake playlists are created based onlogical file names referencing the same area of a disk.

FIG. 30 shows an embodiment where clip slicing and shuffling is combinedwith referencing the shuffled clips by a plurality of different logicalfile names.

FIGS. 31A to 31C show a further embodiment where additional portions arestored on the record carrier.

FIGS. 32A and 32B show further embodiments where an additional portionis stored on the record carrier which is a copy of another portion.

FIG. 33 shows a further embodiment where an additional portion is storedon the record carrier corresponding to a copy of (only) a part ofanother portion.

FIGS. 34A and 34B show a further embodiment where additional portionsare generated and stored on the record carrier, the additional portionsincluding additional content such as e.g. advertisement and the like aswell as copies of other portions stored on the record carrier.

FIGS. 35A and 35B show further embodiments where “long” playlist aregenerated.

FIG. 36 shows a further embodiment where a record carrier comprises acorrect playlist and a plurality of fake playlist (further firstorders). The correct playlist and the plurality of fake playlists eachhave an assigned index number.

FIG. 37 shows a further embodiment where a Blu-Ray disc comprises afirst Java Class File. This first Java Class File, however, includes noinstructions which would allow reproduction of the audio or audiovisualcontent stored on the disc in genuine quality.

DETAILED DESCRIPTION

In the following, embodiments of the invention are described. It isimportant to note, that all described embodiments in the following maybe combined in any way, i.e. there is no limitation that certaindescribed embodiments may not be combined with others. Further, itshould be noted that same reference signs throughout the figures denotesame or similar elements.

It is to be understood that other embodiments may be utilized andstructural or logical changes may be made without departing from thescope of the invention. The following detailed description, therefore,is not to be taken in a limiting sense, and the scope of the presentinvention is defined by the appended claims.

It is to be understood that the features of the various embodimentsdescribed herein may be combined with each other, unless specificallynoted otherwise.

In FIG. 1, at S102 AV data 104 is provided. For example, the AV data maybe provided as an audiovisual (AV) file. It is also possible that the AVdata be provided as streamed content or in any other form. The AV data104 may also be referred to as origin or genuine AV data. It correspondsto AV data which would conventionally be written in one portion, e.g.one file or clip, onto a record carrier, e.g. in consecutive blocks orsectors. In a file system of the conventional record carrier, the AVdata 104 would usually be referenced by a single file name. For example,the AV data 104 may correspond to a complete movie to be stored on arecord carrier.

Thus, the AV data 104 has a genuine playback sequence defined by thecontent of the AV data. The genuine playback sequence corresponds to theplayback sequence as created/recorded e.g. by the director or moviemakerof the content. The genuine playback sequence is, thus, e.g. a playbacksequence of the content as intended by a director of a film or any othervideo content. In the genuine playback sequence, e.g. scenes of a moviewill be reproduced in the correct logical order of the movie.

In order to copy protect the content of the AV data 104, according to anembodiment of the invention, at S106, the AV data 104 may be dividedinto a plurality of portions 104-1, . . . , 104-4. The portions 104-1, .. . , 104-4 have a first order that corresponds to the order derivedfrom the AV data 104. As seen in FIG. 1, in the embodiment, the AV data104 has four portions 104-1, 104-2, 104-3, and 104-4 where a dividing(slicing) is done. Note that the portions are originally not included inthe AV data 104—the portions only serve to illustrate the dividing intothe portions 104-1 . . . 104-4.

At S110, a second order is determined for the portions 108-1, . . . ,108-4. The second order is different from the first order and may alsobe referred to as “scrambled order” or “shuffled order” of the portions108-1, . . . , 108-4. In the embodiment of FIG. 1, the second order is:108-4, 108-1, 108-3, and 108-2. Thus, if the AV data 104 was a movie,then the end of the movie corresponding the portion 108-4 of the moviewould be played in the beginning if the portions 108 were played back,i.e. reproduced, in the second order. However, when using the firstorder for playback, the original content would be reproduced. However,the playback of the record carrier would not be a “linear playback”,i.e. a reading head may not linearly mover over the area of the recordcarrier. In fact, the reading head, e.g. optical pick up would move backand forth in order to jump to different physical positions where therespective portions are stored. This would be a “jumbled” playback (oraccess) with respect to a scanning order of the disc.

At S112, the portions 108-1, . . . , 108-4 are stored on a recordcarrier 114. Thereby, the portions 108-1, . . . , 108-4 are stored inthe second order, i.e. a physical or spatial position on the recordcarrier 114 where a respective portion of the plurality of portions isstored, depends on the second order. As seen in the embodiment of FIG.1, record carrier 114 has a plurality of areas (regions), e.g. blocks orsectors, 116-1, . . . , 116-n that may e.g. correspond to logical blocksin accordance with a format of the record carrier 114. In each of theseregions, a respective portion may be stored. In the embodiment of FIG.1, in the first region 116-4 physically arranged in the middle of therecord carrier the portion 108-4 may be stored. Likewise, in regions116-1, 116-3, and 116-2, the portions 108-1, 108-3 and 108-2,respectively, may be store.

As seen, the second order determines the order in which the portions108-1, . . . , 108-4 are physically stored on the record carrier.Therefore, the second order may also be referred to as “storing order”.Likewise, since the first order at S106 may be used for playback of theAV data 104 in the genuine playback sequence, the first order may alsobe referred to as “playback order”.

Regarding the storing of the portions 108-1, . . . , 108-4 on the recordcarrier, it should be noted that the storing may be such that eachportion is stored in one file of the logical file system of the recordcarrier. In another embodiment, however, it is also possible that someof the portions (a plurality of portions) are stored in one same fileand other portions (a further plurality of portions) are stored in otherfiles. Of course, it is also possible that all portions are stored inone file of the logical file system of the record carrier.

In the embodiment of FIG. 1, portions 108-2 and 108-3 stored in areas116-2 and 116-3, respectively, are stored in one file 115-3 of the filesystem as also indicated by arrow 115-3. Portions 108-4 and 108-1 storedin areas 116-4 and 116-1 are stored as separate files 115-1 and 115-2,respectively.

If several portions are stored in one same file, the first order mayreference (physical) positions on the record carrier where a respectiveportion starts and/or ends. For example, in order to reference portion108-2, the first order may reference beginning position (starting point)117-1 denoting the beginning of portion 108-2, i.e. the beginning ofarea 116-2, and end position (end point) 117-2 denoting the end ofportion 108-2, i.e. the end of area 116-2. If the record carrier is e.g.a Blu-ray disc, the portions 108-1, . . . , 108-4 may be referenced asplay items with respective IN-points (beginning of a portion) andOUT-points (end of a portion)—see also FIG. 2. Thus, there may be playitems referencing portions in a same file or in different files.

In the embodiment of FIG. 1, there are only four portions 108 shown. Inreality, however, the number of portions may be much larger. Forexample, the portions may have a length of about one minute ofaudiovisual content. If the AV data 104 is a movie with a length of 120minutes, there would e.g. be 120 portions 108 that will be stored on therecord carrier. Other possible values for the length of the portionsare: 10-20 seconds, 10-30 seconds, 30 seconds to 1 minute, 1 minute to 2or 3 minutes, 3 minutes to 5 minutes, and/or 5 to 10 minutes. Also,shorter or longer files are possible. As indicated by the sizes of theportions 108-1, . . . 108-4 in FIG. 1, the length of different portionscan be different. The sizes could also be the same for all or a part ofthe AV portions.

As mentioned, when the portions are played back according to the secondorder, i.e. in the order as physically stored on the record carrier, thecontent of the AV data 104 will not be reproduced in the genuineplayback sequence. In fact, the content would at least partly bereproduced in a complete disorder such that a viewer cannot enjoy thecontent and will be dissatisfied.

Thus, in order to enjoy the content of the AV data 104, the first ordermust be known. If the first order is not known, the record carrier isuseless since the original AV content cannot be reproduced satisfyingfor the user. It may be that e.g. some scenes from an end of a movie beshown in the beginning and vice versa portions from the beginning of amovie would be shown at the end when playing back the files in the orderas physically arranged on the record carrier.

Thus, if a copier, i.e. a person (hacker) or copy program, copies orrips the portions stored on the record carrier, the copy will be uselessunless the first order is known or can be determined when playing backthe portions. Only if the portions are played back in the first order,the content of the AV data will be reproduced in the genuine (original)playback sequence.

Further, if there is a sufficient number of portions finding the firstorder by hand will be very cumbersome or impossible. In order to make iteven harder for a person to try finding the first order by watching theportions it may be effective to divide the AV data such that at least apart of the portions start with a beginning of a scene or end with anend of scene of a movie. In this case, there is no clue for the firstorder derivable from a certain ending of a portion and/or from abeginning of a portion. Moreover, the process of finding the first orderautomated is more difficult since no audio and/or video patterns at thebeginnings and/or endings of portions can be analyzed in order to findportions that are subsequent files in the first order.

There also exist some copy programs that automatically try findinglongest/largest files on a record carrier assuming that such large filescontain the main movie. However, if at least some portions will berespectively stored in a separate files since these resulting files arerather small in size, such program will fail. It is also possible tospecifically confuse such copy programs or have such copy programs makeuseless copies. This is e.g. possible by only applying the dividing andscrambling of portions for certain portions of the AV data. For example,the dividing may only be applied to a portion of the AV datacorresponding to the last 10-20 minutes of a movie. Thus, a copier orcopy program may see a large AV file corresponding to a large portion ofthe movie and several smaller AV files that may or may not be stored inthe scrambled order on the record carrier (in this case at least someportions will be stored in separate files). In case the copy programthen only copies the largest file assuming that this corresponds to themain movie and the smaller files correspond e.g. to bonus material,extra AV material or the like, a respective copy will be dissatisfyingsince e.g. the end of a movie would be missing.

Also, it is possible to apply the scrambling selectively to only aportion of the portions. Thus, the “disorder” that a viewer willexperience when viewing the portions in the order as physically storedon the record carrier depends on the scrambling. If the scrambling ise.g. only done for portions corresponding to the end of a movie, then acopier might not notice immediately that a file-by-file copy of therecord carrier is actually useless unless the first order is known sincethe end of the movie will be played back in a disorder. Of course, thescrambling could also be done for portions corresponding to a beginningor middle portion of a movie.

Thus, from the above, it is clear that the method for copy protection asexplained exemplary at S102, S106, S110, and S112 in FIG. 1 is veryeffective. In order to hack the copy protected content, a high effortwould be necessary in order to find the correct playback order for theportions 108 stored on the record carrier 114.

On the other hand, as is also clear, the first order should be protectedin some manner. This may e.g. be done by storing the first orderencrypted or obfuscated (hidden) on the record carrier. Also, the firstorder may not be stored on the record carrier at all. In this case, thefirst order might be provided for download on a server. Downloadingmight be controlled by an authentication process. The protection of thefirst order will be detailed below.

As should also be clear from the embodiment of FIG. 1, the basicprinciple explained, i.e. the dividing of a large amount of AV data,e.g. a large file, into a, e.g. large, number of smaller portions orfiles and shuffling (scrambling) of the small files/portions, may beapplicable to many types of record carriers. It could be used for copyprotecting Blu-ray discs (BD), digital versatile discs (DVDs), CD-ROMsor any other possible future video storage format. The basic principlecould also be applied to content stored on hard discs, removable memorysuch as e.g. RAM storage or downloaded e.g. streamed content. Forexample, it may be possible that a large number of small AV files(portions) are offered for downloading at various servers. The correct(first) order of the AV files that will allow reproducing the contentdistributed across the AV files might, however, only be available at onesource. This could be only one server where a strict authenticationprocess is performed that will allow downloading the first order.Alternatively and/or additionally it would also be possible todistribute the first order via a memory product, e.g. removable memory(media card, USB memory stick), by mail. The first order could also bederived from an unlock key that a user has to enter into a playbackdevice for the record carrier. The unlock key could be printed onto therecord carrier or onto its case. Also, the first order could be derivedautomatically from an identifier of the record carrier. For example, ifthe record carrier is a Blu-ray disc, the PMSN (pre-recorded mediaserial number) or a volume ID of the disc could be used to automaticallydetermine (decode or de-obfuscate) the first order.

When the basic principle is applied for downloading/streaming content ina copy protected manner, it is also possible that a different order ofthe files is provided for download for each individual user. In thiscase, the first order for one (second) order of portions or filesdownloaded by one user will be useless for another (second) order ofportions or files downloaded by another user. The second order mighte.g. be indicated by the file names of the AV portions and/or by headerinformation in the portions or files.

The mentioned copy protection of downloaded/streamed content (byslicing/scrambling) could be used for any kind of content e.g. (only)audio content, audiovisual content or other multimedia content e.g.downloaded video game content. In this case it would be e.g. audio dataor other multimedia data that is divided into portions that are thenscrambled.

As mentioned, the AV data 104 shown in FIG. 1 may be arbitrarily dividedinto the portions 108. However, as also already mentioned, in anotherembodiment it is also possible that the cuts indicated in FIG. 1 for AVdata 104 be determined dependent on the content of AV data 104. Forexample, cuts, i.e. a position where the AV data 104 is divided into twoportions, may be chosen to correspond to scene changes of the content.Thus, the beginning of some of the portions 108 may correspond to abeginning of a scene of the content, e.g. a movie, and/or the end ofsome of the portions 108 may correspond to an end of a scene of thecontent.

The cuts may also be set such that subtitles of e.g. a movie not besplit into separate portions. For example, a subtitle may be displayedfor a certain period during playback, e.g. 10 seconds. The dividing inthis case may be such that the portion of the AV data for which thissame subtitle is displayed not be split into separate portions. Anadvantage of this is that the resulting portions may not need to bere-encoded. In fact, the AV data may only need to be split up. Also, itis more difficult for hackers to determine portions that should in thegenuine playback sequence be played back consecutively. A same subtitlein two different portions would be a clear hint for hackers that suchtwo portions should be played back consecutively.

Thus, an advantage of a division according to the content may be that itis more difficult to determine the first order since it is not easy toguess a portion that is subsequent to another (preceding) portion in thefirst order based on the beginning and/or end of thesubsequent/preceding portion. Moreover, it will be difficult orimpossible to use automated copy programs that may try to use picture oraudio patterns of the portions in order to try determining the firstorder.

Also, in case the AV data is encoded according to the MPEG-2 standard,the cuts may be such that a resulting portion starts with a full frame,e.g. an I-frame. In case the AV data is encoded according to theMPEG-4/H.264/AVC standard, the cuts may be set such that a resultingportion starts with a full frame, e.g. a IDR frame. An advantage of thisis again that the resulting portions may not need to be re-encoded. Infact, the AV data may only need to be split up and the original codingof the AV data may be used. This will help to have a simple work-flowwhen using the method for copy protection in practice, e.g. in a processof manufacturing copy protected record carriers. The AV data can bedelivered encoded and the original encoding be used throughout themanufacturing process.

As seen at S112 in FIG. 1 and as will be mentioned in furtherembodiments detailed below, files or clips (e.g. portions) or other datasuch as e.g. program instructions is stored on a record carrier. This isdone by modifying the physical structure of a recording medium. Forexample, if the record carrier is a hard disk, magnetic properties ofthe respective recording medium will be altered/modified in order tostore the data. If the record carrier is an optical record carrier, e.g.optical disc, such as e.g. a DVD, BD and CD-ROM, pits and/or lands maybe imposed onto the respective recording medium.

It should also be noted that throughout the description, the “firstorder” may also be referred to playlist. In this sense, the term“playlist” is understood as a list indicating a playback order forplayback of files or clips of the list. The term “playlist” is not to beunderstood as being limiting to a certain standard, e.g. Blu-raystandard, where the term playlist may have a certain meaning. A playlistcould likewise just mean that files stored on a hard disc will bereproduced in the order defined by the “playlist”. Since the “secondorder” determined the order for the physical storage on the recordcarrier, the second order may also be referred to as “storing order”.

As mentioned, the basic principle of dividing a AV data into a pluralityof portions is applicable to many different types of record carriersand/or downloaded/streamed data. However, in the following, forillustrative purposes only, examples for exploring the above concept areexplained at the hand of a Blu-ray (BD) disc.

As shown in FIG. 2, the audiovisual data on a BD is organized indifferent logical layers 118, 120, and 122. Three layers may beimportant in the context of dividing/slicing AV data and reproducing thefirst order at playback as explained above:

-   -   Layer 118: Movie Object/BD-J-Object 124    -   Layer 120: Movie playlist 126 that contains PlayItems 128    -   Layer 122: AV Clip Files (hereinafter referred to simply as        “Clip”)

The Clip 130 contains the actual audiovisual data, i.e. the data thatcan be interpreted as sound and images. Apart from the actualaudiovisual data the clip 130 may contain some metadata in form of apresentation graphics stream or an interactive graphics stream. Thepresentations graphics stream may e.g. be used for displaying subtitles.The interactive graphics stream may be used for displaying interactivemenus. In fact, the clip 130 may be referred to as a container foraudiovisual content, i.e. it may contain primary audio and video,secondary audio and video, presentation graphics (e.g. subtitles), andinteractive graphics (e.g. menus with button navigation commands).

The movie playlist 126 is a collection of the PlayItems 128. EachPlayItem 128 represents an interval of a single clip 130 and consists ofa start time (IN-point) and an end time (OUT-point), both of which referto points in the playing time of the associated clip.

The movie Object and/or BD-J Object 124 is/are responsible fortriggering the playback of the playlist 126 and to provide navigationalstructure. A Movie Object 124 is an executable navigation commandprogram and, as such, contains program instructions. A typical examplefor a navigation command is the command to play a playlist. Apart fromthe basic navigation commands, the BD standard provides an adaptableapplication environment that can be programmed by using the Javaprogramming language. BD-J Objects are Java programs comprising programinstructions that can be executed in this environment.

The hierarchy of layers 118, 120, 122 is shown in FIG. 2. It should benoted that this is a simplified illustration, which omits structuressuch as the index table.

From within the movie object or BD-J object 124 a “Play” command isissued for the Movie playlist 126, triggering the consecutive playbackof the PlayItems 128-1, 128-2 contained in the playlist 126. EachPlayItem 128 references a (time-based) start and end position in asingle clip 130. The content of the associated clip located between thestart and the end position is played back for each PlayItem 128. Notethat different PlayItems 128 contained in a single playlist need not allreference the same clip. In the example of FIG. 2, the shown playlistplays only the portions of the clip which are not shaded.

If the record carrier 114 in FIG. 1 was a Blu-ray disc and the playlist126 would include the first order, then PlayItems 128-1, 128-2 and thefollowing PlayItems (not shown in FIG. 2) could reference the portions108-1, . . . , 108-4 by respective IN-points and OUT-points.

In the following description, in most of the examples AV data isprovided as a (primary) AV file or clip that would conventionallywritten to a record carrier in one file or one same area. Moreover, theAV file is then explained as to be split into a plurality of (secondary)files or clips. The secondary files or clips correspond to the portions108-1, . . . , 108-4 of FIG. 1. This should not be seen as limiting inany sense. As explained at hand of FIG. 1, a plurality of portions (theportions 108-1, . . . , 108-4) may be stored on the record carrier inone file (or clip in case of a Blu-ray disc) oralternatively/additionally a plurality of portions may be stored inseparate files such that each portion is stored in one file or clip.

FIGS. 3A to 3C show an embodiment where clips 132-1, 132-2, 132-3 thatwould usually (conventionally) be stored on a Blu-ray disc in respectivesingle files are divided (sliced) into smaller clips 140 that are thenstored on the Blu-ray disc, e.g. a prerecorded (original) Blu-ray disc.

FIG. 3A shows how a conventional Blu-ray disc might look like. Theexample of FIG. 3A is simplified in that the simplified model of FIG. 2is used and it is assumed that a BD title is stored with no extrafeatures. There is only a first clip 132-1 that may e.g. correspond to atrailer, a second clip 132-2 that may e.g. correspond to a main movieand a third clip 132-3 that may correspond to some promotional contentthat should be played after the main movie. As seen in FIG. 3A, a singlemovie/BD-J object 134 is responsible for triggering playback of themovie playlist 136. In the example of FIG. 3A, the movie playlist 136contains three PlayItems 138-1, 138-2 and 138-3, i.e. one PlayItem foreach of the three clips 132-1, 132-2, 132-3 contained on theconventional Blu-ray disc. The IN-points and OUT-points of each PlayItem138-1, 138-2, 138-3 correspond exactly to the beginning and the end ofthe associated clips 132-1, 132-2, 132-3. This means that once playbackof playlist 136 is triggered, the three clips 132-1, 132-2 and 132-3 areeach played from the beginning to end in consecutive order.

In order to copy protect the clips 132-1, 132-2, and 132-3 (AV data),the clips are divided or sliced into a number of smaller clips 140-1, .. . , 140-6 (portions). The clips 140-1, . . . , 140-6 may correspond toa video sequence of approximately one minute of playback time. In otherembodiments, the clips may have a length in the ranges of 30 seconds toone minute, one minute to three minutes, three minutes to five minutesand/or five to ten minutes. The clips need not have the same length foreach of the files.

According to the present BD standard, the upper limit for the number ofclips on one disc is 4000. This may be taken into account when slicingthe AV data.

As shown in FIG. 3B, it is not necessary that every original clip 132-1,132-2, 132-3 be divided into a smaller clip (a portion of the originalclip). For example, original clip 132-3 (AV data) is not divided intosmaller clips. Thus, it is possible to apply the principle of dividingAV data into a plurality of AV portions selectively. For example, if thethird clip 132-3 contained promotional content or advertisements, theremay be no need to copy protect the third clip 132-3 by dividing it intosmaller clips (and apply the shuffling as detailed below when describingFIG. 3C).

In a further embodiment, it is also possible to divide only a part of a(primary) clip into smaller clips (portions) and leave the rest intact.For example, it may be possible to leave the beginning of a movie intactto make copiers and rippers believe they have succeeded when they onlyview the beginning of copied content. However, then the end of a(primary, original) clip may be divided such that the end of a moviewould be scrambled if the movie would be viewed in the scrambled order(cf. FIG. 3C).

Moreover, if there is one larger AV file stored on a disc, copiers mayonly copy this long AV file not noticing that the smaller AV filesbelong to the end of a movie. Thus, the experience of a viewer is verypoor because he might miss the end of a movie.

As seen in FIG. 3B, three clips 132-1, 132-2 and 132-3 are divided intosix smaller clips 140-1, . . . , 140-6. This is a non-limiting examplefor illustrative purposes. In real application, the number of clips(portions) can be significantly higher. For example, for a movie havinga length of 120 minutes, there may be around 120 clips when the smallclips have e.g. an average length of one minute. Thus, the number ofclips (portions) depends on the length of the different smaller clips aswell as on the strategy (e.g. only divide the beginning/middle/end of AVdata) applied when dividing the original clips (AV data).

After the clips 132-1, 132-2, 132-3 have been sliced/divided theresulting smaller clips (portions) 140-1, . . . , 140-6 have a firstorder. If the clips (portions) 140-1, . . . , 140-6 are reproduced inthat first order, the content of the (primary, genuine, original) clips132-1, 132-2, 132-3 will be reproduced in the genuine playback sequence.

However, as shown in FIG. 3C, the clips 140-1, . . . , 140-6 may beshuffled or scrambled. After shuffling/scrambling the clips 140-1, . . ., 140-6 have a scramble (second) order: 140-3, 140-1, 140-5, 140-2,140-6, 140-4. The clips may then be stored on the BD in the scrambledorder (second order). Thus, a physical or spatial position on the disc(record carrier) where a respective clip 140 (portion) is stored dependson the order after the shuffling/scrambling (cf. also record carrier 114in FIG. 1). As is readily apparent, this will prevent hackers fromextracting the clips in the sequence in which they appear in the filesystem of the disc, or as they physically appear on the disc.

As seen in FIG. 3C, the shuffling also interchanges clips 140 that didnot originate from the same original clip. As is also clear, extractingthe clips 140 in the order shown in FIG. 3C and in accordance with thefile system or physical position on the disc and joining them into moviewould result in a complete disorder. Not only would the originalfeature/content be completely out of logical order, there would also beshort spans of trailer and promotional content showing up duringplayback if, as exemplified above, the clips correspond to a trailer,main movie and bonus material.

There is also the possibility to introduce new clips that can e.g.contain information on how to obtain a legal copy of the Blu-ray disc.These clips could be shuffled into the clips that result from theslicing/dividing. This option is not shown in FIG. 3, however, will beexplained below (cf. e.g. FIGS. 6 to 8).

It may also, in a further embodiment, be possible to only store some ofthe sliced clips 140 on the disc, i.e. to not store all clips on thedisc. The clips that are not stored on the disc might e.g. be providedon a server for download (cf. e.g. FIG. 9).

As evident from the examples of FIG. 1 and FIG. 3, the shuffling of theclips, i.e. determining the second order, may be done completelyarbitrarily. However, it is also possible to control the shuffling suchthat a resulting Blu-ray disc comprising audiovisual files in the secondorder, is in conformity with the BD specification. This will allow aseamless playback, i.e. on a playback device there will be sufficientbuffering to prevent pause or freeze frame in playback. According to theBD specification, the maximum distance for two clips to be Joinedseamlessly is (on a BD-ROM) 640000 logical blocks (intra-layer) and40000 logic blocks (inter-layer). Therefore, in a further embodiment,the algorithm employed for shuffling, i.e. the algorithm for determiningthe second order, may ensure that two clips to be consecutively playedback according to the first order are never further apart then 640000logical blocks. In other words, a first AV portion and a second AVportion which follow each other consecutively in the first ordercorresponding to the order that allows playback of the AV portions toreproduce the genuine content have a physical distance from each otherthat is not larger than an allowed physical distance specified by astandard of the record carrier, e.g. BD specification. This will allowthe AV portions to be reproduced seamlessly on any player that is inconformity with the respective standard. A record carrier where theportions are arranged in this manner may be referred to as being“in-spec”, i.e. in conformity with a specification of a certainstandard.

It should be noted, however, that empirical tests have shown that alsomuch larger distances may work. Many players may e.g. have a largermemory than required by a certain specification such that it is possibleto buffer a large amount of video data in order to allow a seamlessplayback.

In order to further improve the copy protection, the (first) order ofthe sliced clips should not be guessable easily. Therefore, the recordcarrier should not contain clues that would allow the reduction of theaforementioned effort. This may include, but is not limited to:

-   -   clues from the position of the clips on the record carrier;    -   clues from the naming of the files; and    -   clues from references within the data.

Thus, it is clear, that the reference numerals used e.g. in FIGS. 1 and3 are certainly not a good option for respective file names. Such filenames would make it easy to determine the first order which should ofcourse be avoided. Also, as is clear certain patterns in the physicalarrangement of the files on the disc should be avoided.

In order to further enhance the copy protection, the correct order(first order) of the sliced AV files may be stored on the record carrierin an obfuscated manner. A “key” or “key material” for de-obfuscation(“decryption”) of the first order may e.g. be derivable from parametersof the disc like e.g. the integrity of the file system or encryptionparameters, encryption characteristics, access characteristics of thedrive for reading the disc and so on. It is also possible to read byteand/or bit values of encrypted content and use these byte values as keymaterial for de-obfuscation (see e.g. FIGS. 19A-19J).

Further details on how a key may be derived will be given below.However, for a better understanding already now, the following should benoted:

Every record carrier has a certain physical structure and containscertain data stored thereon. Thereby, the physical structure of apre-recorded record carrier is generally different from a copy of thepre-recorded record carrier e.g. on a recordable record carrier such ase.g. a recordable optical record carrier or hard disc. For example, ifthe pre-recorded record carrier is an optical record carrier, on thepre-recorded record carrier, certain patterns of pits and lands mightexist that are different on the recordable record carrier, since e.g. acopier (e.g. copy program) cannot copy the certain patterns. On apre-recorded record carrier the physical structure and data is inscribedin a glass mastering process and mass replicated via stamping, while ona recordable record carrier the physical structure is preinscribed andthe data is burned with a high-power laser beam (by changing thetransparency of a dye) in a recording device.

Also, e.g. if the pre-recorded record carrier has copy protectedoriginal data stored thereon and a recordable record carrier is a copyof the pre-recorded record carrier having copied data, the original dataand copied data might be different. For example, in the copied data,encryption characteristics or encryption parameters of the original datamight not be included. Further, e.g. the file system of the copied datamight deviate from that of the original data.

Thus, from a pre-recorded (original) record carrier, certain originalcharacteristic parameters (a “key”) may be derived. These originalcharacteristic parameters may depend on the physical structure of thepre-recorded (original) record carrier and/or on the (original) datastored on the pre-recorded (original) record carrier. The originalcharacteristic parameters of the physical structure may be extractedfrom the pre-recorded carrier by a reading device, e.g. an opticalpickup or a reading head of a hard disk, i.e. a reading device might becontrolled to access the physical structure in a certain manner.

Also, from a recordable record carrier that is a copy of thepre-recorded (original) record carrier, certain copy characteristicparameters may be derived. These copy characteristic parameters maydepend on the physical structure of the recordable record carrier and/oron the copied data stored on the recordable record carrier. The copycharacteristic parameters of the physical structure may be extractedfrom the recordable carrier by a reading device, e.g. an optical pickupor a reading head of a hard disk, i.e. a reading device might becontrolled to access the physical structure in a certain manner.

If the manner in which the copy characteristic parameters are extractedfrom the recordable record carrier is the same as for extracting theoriginal characteristic parameters from the pre-recorded record carrierand if the copy characteristic parameters deviate from the originalcharacteristic parameters, this may be used in various ways. Forexample, it could be used for detecting that data is read from a copy(original disc check). Moreover, the parameters could be used forvarious algorithms for copy protection.

Here, the original characteristic data and copy characteristic data mayalso be referred to as “key”, “key material” or “key data” that isexplored in various ways for copy protecting data, e.g. AV data, storedon a pre-recorded record carrier. The keys may e.g. be used as inputdata for algorithms for finding a correct playlist, authenticationpurposes e.g. at a server, controlling of playback quality (e.g. genuineor reduced quality), and/or preventing playback altogether.

Also, the key data (characteristic data) may also be determineddynamically. For example, if a program, e.g. a movie or BD-J object of aBD, is used for playback of AV content, the program may during playback,i.e. dynamically, at various times determine respective key data (i.e.original characteristic data if data is read from an original recordcarrier or copy characteristic data if data is read from a copy).

The first order may also be protected as shown in the embodiment ofFIGS. 4A (showing the single correct movie playlist) and 4B (showing alarge number of fake movie playlists). As shown in FIG. 4A, there may beone correct playlist 142 that comprises Mayhems 143-1, . . . , 143-6referencing the clips 140-1, . . . 140-6 (same reference numerals as inFIGS. 3B and 3C) in the correct order (first order). Thus, as seen inFIG. 4A, the PlayItems 143-1, . . . , 143-6 reference the clips 140-1, .. . , 140-6 in ascending order. Of course, the physical access forplayback of the clips 140 is dispersed over a wide range since thephysical positions of the clips 140 are scattered across the disc.However, if playback of the correct playlist 142 is triggered, then thesame sequence is played back that was played back in the original set-upas shown in FIG. 3A. Thus, e.g. first the trailer (clip 132-1) will beshown then the main movie (clip 132-2) and then the promotional content(clip 132-3).

If the shuffling was done so that the second order results in physicalpositions of consecutive clips according to the BD specification(“in-spec”, see above), a seamless playback is possible on a BD playerthat is in conformity with the BD specification.

In order to avoid that the correct movie playlist 142 (first order) beeasily derivable from the disc, or from elsewhere, it is possible that alarge number of fake playlists (further first orders, i.e. furtherplayback orders) is created and stored on the disc. As shown in theexample of FIG. 4B, there may be n playlists 144-1, . . . , 144-ncreated. In other words, a plurality of further playback orders may bedetermined and stored on the record carrier, wherein the furtherplayback orders are different from the first order and possibly alsodifferent from each other (the latter is not necessary).

If all of the playlists, i.e. the correct playlist 142 as well as thefurther playlists (“fake playlists”, further first orders) 144 arestored on the disc, and if there are a large number of further playlists144, it will be a difficult task for a copier to find out which of theplaylists is the correct one, i.e. the first playlist is obfuscated.

This may be especially the case if the original clips are divided atplaces where scene changes occur in the original video content and alarge number of fake playlists appear to result in similar contentreproduction at first sight. Additionally, the content reproduction whenusing any of the further playlists (further first order) could besimilar to the content reproduction when using the correct playlist(i.e. the first order). In other words, in a further embodiment, it ispossible that the correlation of all playlists stored on the disc (i.e.the correct playlist and the fake playlists) is high, i.e. all playlistsresult in a content reproduction that is similar at first sight. Thismakes it difficult for copiers to determine the correct playlist (firstorder) among the fake playlists (further first orders). A determinationby hand is difficult since all content reproduction seem similar atfirst sight and a determination automatically is also difficult for thesame reason and also since the correlation between all playlists storedon the disc is high, so that the correct playlist may not easily bedetermined by e.g. automatically determining a correlation or othersimilarity measure. Of course, not all playlists stored on the disc mustbe similar. It could also just be a part. This could also confusecopiers.

According to the BD-ROM standard/specification, there are 2000 playlistsallowed. Thus, in the example of FIG. 4B, n may be equal to 1999, i.e.there may be up to 1999 fake playlists (further first orders) stored onthe disc. Of course, different values for n are possible. Reasonablevalues of n may be 10, 100, 200, 300, . . . , 1999.

In order to playback an original Blu-ray disc that is copy protected by(i) dividing original clips into smaller clips and (ii) storing a largenumber of fake playlists on the disc, it is necessary to find out thecorrect playlist when a user wants to playback the content stored on thedisc.

Therefore, as shown in FIG. 5A, a new movie/BD-J object 146 may becreated. This BD-J object may contain program instructions (code) tocheck if the Blu-ray disc from which content is played back is anoriginal or pre-recorded disc or whether the disc is a copy or playbackis from a hard disc (“ripped content”). This original disc check may beperformed in many different ways. Details are given below (see also e.g.FIGS. 12 to 20).

In a further embodiment shown in FIG. 5B, it is also possible that “faketitles” (additional titles that are created for obfuscation purposes)are stored on the Blu-ray disc. The BD standard allows having up to 999titles (BD-J objects and/or Movie objects) on one disc. According to thefurther embodiment with “fake titles”, there may be stored on the disconly one or a predetermined number of “correct titles”, i.e. titles thatwill lead to playback of the original AV content in the genuine playbacksequence. In the example of FIG. 5B, there is only one correct title145-1 and the titles 145-2, . . . , 145-n are additional (fake) titlesthat will not lead to playback of the content in the genuine playbacksequence or genuine quality.

The playback may be initiated by selecting the First Play title (FPtitle) according to the BD standard (referenced by index “−1” in theindex table). It would also be possible to initiate playback by the TopMenu title (referenced by index “0” in the index table).

The correct titles may be discriminated from the fake titles in the samemanner as the correct playlist (first order) from the fake playlists(further first orders), i.e. by extracting “key parameters” from thedisc and using these as input data for program instructions that thenselect the correct title for playback of the content. Also, it ispossible, that one title on the disc only plays back a portion of the AVdata (original content) and another title is dynamically determinedduring playback of the disc, which other title then is responsible forplaying back the remaining portion of the AV data. In each of thetitles, again several playlists could be included, wherein only one or apredetermined number of playlists lead to playback in the genuineplayback sequence.

In FIGS. 5A and 5B, based on the result of the disc check, differentoptions exist. If the disc check succeeds, then the BD-J object 146 maytrigger playback of the correct movie playlist 142 and/or correct title145-1 as opposed to a fake title 145-2. If the disc check fails, then anappropriate message may be displayed to a viewer or a randomplaylist/title, i.e. a fake playlist 144 and/or fake title 145-2, may beused for playback. The information which playlist/title is the correctone may be available to the BD-J object 146 only in encrypted form. Inorder to decrypt this information, data (original characteristic data,see definition above) from the original disc may be required. Forexample, a BD-J object of a title may decrypt, i.e. discriminate acorrect playlist 142 from the fake playlists 144-1 to 144-n and/or acorrect title 145-1 from all of the titles 145-1, . . . -145-n, based onencryption characteristics or parameters such as e.g. AACScharacteristics (also referred to as “parameters”). Moreover, suchparameters as e.g. a PMSN (pre-recorded media serial number) or a volumeID stored in the ROM mark may be used. Also, AACS encrypted contentcould be used. In this case when copy protecting the disc, the BD-Jobject, a part thereof (e.g. a Java Class File, see e.g. FIG. 19E),and/or a playlist may be created based on AACS encrypted content (byreading bytes at certain positions, cf. FIGS. 19A to 19J). In otherwords, only if content is AACS encrypted, the BD-J object will be ableto determine the correct playlist 142 among the fake playlists 144-1 to114-n and/or the correct title among the titles 145-1, . . . , 145-n.Thus, in this case the correct playlist 142 and/or correct title 145-1may be determined dynamically during playback. In other words, theplaylist 142 and/or the title 145-1 might not at all or not completelybe known to a player at the beginning of playback.

This is a dilemma for copiers: If they remove the AACS encryption theycannot use the original BD-J object any longer for genuine playbacksince the BD-J object may only be used for determining the correctplaylist if the encrypted content data (original characteristic data) isused as input data. On the other hand, if the AACS encryption is notremoved it is very difficult or impossible to make a copy from which thecontent can be played back. This will also be detailed below.

Moreover, in addition, to selecting a correct playlist from a largenumber of playlists (including fake playlists) it is also possible toselect an angle (see embodiment in FIG. 8) or sub-path (see embodimentin FIGS. 21 to 24) depending on the “key” (characteristic data extractedfrom the disc, i.e. the original characteristic data in case of anoriginal and the copy characteristic data, see above). In other words,the title (BD-J object and/or Movie object), the playlist, the angle andthe sub-path may all in various combinations be selected depending onthe “key” extracted from the disc. In each case, there maybe “fake”instances, e.g. fake titles, fake playlists, fake angles and/or fakesub-paths that need to be discriminated from the correct titles,playlists, angels and sub-paths in order to have the original contentreproduced in the genuine playback sequence and/or genuine quality.Thus, there is a powerful toolbox for designers of a copy protectionscheme for one individual disc. For example, on one disc, the designermay choose to only work with the concept of additional (fake) angles andtitles, whereas for another disc, the designer may only use the conceptof additional (fake) playlists. This will confuse copiers, since anextremely large possibility for obfuscation of the correct playback ofthe clips, files, and/or portions of a disc can exist.

FIG. 5A illustrates playback with the original Blu-ray disc in place,i.e. in a player. For secure playback, the BD-J object 146 checks thedisc and extracts a “key” (key material) from the disc. The “key”corresponds to the data mentioned above from the original disc, such ase.g. encryption parameters, PMSN, volume ID, portions of AACS orotherwise encrypted content and/or the like. Also, accesscharacteristics of an optical pick-up when accessing the AV portions orfiles may be used for key purposes. This may e.g. help detecting if thesecond order, i.e. the order in which the files are physically stored onthe (original) disc, has been modified. With the key as input data theBD-J object can discriminate the correct playlist 142 from the plethoraof available playlists 144-1, . . . , 144-n (fake playlists).

It should be noted that the “key”, that may also be referred to ascharacteristic parameters of the disc, may only be read/determined froman original (e.g. pre-recorded) disc or a “managed copy” of an originaldisc and cannot be transferred to an illegal copy or to a hard disc. As“managed copy” a copy managed according to the AACS specification ismeant. For example, it is not possible to transfer a PMSN or volume IDstored in a ROM mark onto an illegal copy. Also, encryption parameterssuch as e.g. AACS parameters/folders may not have been transferred to anillegal copy. If the key depends on such parameters, then it will not bepossible to discriminate the correct playlist, title, angle, and/orsub-path from the fake playlists, fake titles, fake angles and/or fakesub-paths when playback is from an illegal copy.

In order to support “managed copies” according to the AACS standard, itmay be useful to adapt the program instructions for determining thecorrect playlist, correct title, correct angle, and/or correct sub-pathsuch that the PMSN is not used as key material since the PMSN cannot betransferred properly onto a recordable disc. On the other hand, it maybe possible to design the program instructions, such that if a “managed”(i.e. legal) copy is detected, the PMSN or volume ID is read in modifiedform from the managed (legal) copy.

Furthermore, the operation of the BD-J object 146 may be secured frominspection: the employed code obfuscation method may make it impossibleto “eavesdrop” on the operation of the disc check and key extraction andmovie playlist/title/angle/sub-path selection. For this purpose, in afurther embodiment, the program instructions for discriminating thecorrect and the fake playlists/titles/angles/sub-paths may beintertwined with other program instructions of the BD-J object which aree.g. used for controlling playback, subtitles, languages, userinteraction, navigation commands or a menu that will be displayed to aviewer e.g. when the disc is inserted into a player or upon requestingthe menu by operating a respective key e.g. on a remote control. Itwould also be possible to create fake (“dummy”) instructions leading tolong code.

As is clear from the example, for a user owning the original Blu-raydisc with the scrambled AV files, the copy control mechanism iscompletely transparent. The viewing experience is exactly the same as ifa non-protected disc was played, i.e. a disc without the scrambled smallAV files.

FIGS. 6A to 6C show a further embodiment where besides clips whichcontain portions of a primary (genuine) AV file 148, e.g. comprising amovie, additional clips (see e.g. clip 152-4′) may be added. As seen inFIGS. 7A to 7D, the additional clips may be referenced by fake movieplaylists and, thus, serve for copy protection purposes. The additionalclips (additional files) may include but are not limited to

-   -   advertisement content (e.g. genuine clips with superimposed        promotion content),    -   clips with copyright information,    -   information on how a legal copy of the record carrier could be        obtained,    -   genuine clips with reduced entertainment value (e.g. by        distortion or removal of content),    -   copy barriers.

A “copy barrier” may be an unreadable or non-reproducible area or regionof a disc or a file that cannot be read by a player e.g. since itcontains a certain physical structure that will cause a player to abortor slow down a reading of the disc. Such areas are e.g. described inEuropean patent application EP 1 818 924 A1 the contents of which ishereby incorporated by reference.

FIG. 6A shows a single clip (AV data) 150 that should be written to aBlu-ray disc in a copy protected manner. If clip 150 was written to aconventional disc without copy protection by slicing/shuffling asexplained above, a playlist 148 referencing a single PlayItem would beused.

In order to copy protect clip 150, clip 150 is sliced into a number ofsmaller clips 152-1, . . . , 152-6, as shown in FIG. 6B.

As shown in FIG. 6C, an additional clip 152-4′ (additional file) isinserted. This additional clip 152-4′ may contain junk data or any ofthe other types of content mentioned above, e.g. advertisements,copyright information and so on. Also, the additional clip 152-4′ mightcontain a copy barrier as detailed above.

The insertion of additional clips such as clip 152-4′ can of course becombined with clip shuffling. In other words, the order of clips 152-1,. . . , 152-6, and 152-4′ may be scrambled. This is shown in FIGS. 7Aand 7B. FIG. 7A shows the correct movie playlist 154 which puts theshuffled clips 152-1, . . . , 152-6 back into the original order (firstorder). Note that playlist 154 does not include a PlayItem PIreferencing additional clip 152-4′. Thus, this additional clip 152-4′will not be played back/accessed during playback using playlist 154.

Thus, e.g. advertisings may not be reproduced when using playlist 154for playback. Moreover, if the additional clip 152-4′ contained a copybarrier, a reading process of the disc might not be disturbed by anunreadable or non-reproducible portion/sector.

As seen in FIG. 7B, apart from this correct playlist 154 other playlists156 (further first orders) may exist. While FIG. 7B only shows one suchadditional playlist, in practical applications there could be a largenumber of additional playlists (further first orders) as explainedabove, e.g. up to 1999 playlists. In fact, as explained above, a largenumber of fake playlists 156 may be advantageous since it will not beeasy to find out which among the large number of playlists stored on thedisc is the correct one. The difference to the examples in FIGS. 3A to3C and FIGS. 4A and 4B is that the fake playlists 156 can now alsoreference the additional clip 152-4′ as shown for the playlist 156. Notethat this is not necessarily the case for all fake playlists (allfurther first orders). In other words, there may be fake playlists thatreference the additional clip 152-4′ whereas other fake playlists on thesame disc do not reference the additional clip 152-4′. As mentioned, theadditional clip 152-4′ may contain junk or advertisement content.

If the additional clip 152-4′ includes a copy barrier (see above), thena reading process of the disc may be disturbed or aborted. Thus, thisadds a further measure for enhancing copy protection since it ispossible that all or the majority fake playlists reference an additionalclip with a copy barrier. This way, reading unless with the correctplaylist may be completely prevented.

Depending on the desired reduction in the viewing experience, thecreation of “advertisement playlists” is an option. An example of anadvertisement playlist 157-A is depicted in FIG. 7C. The advertisementplaylist 157-A may allow reproduction of the genuine playback sequence:as indicated by the arrows, the PlayItems PI subsequently referenceclips 152-1, 152-2, 152-3, 152-4′, 152-5, and 152-6. However, some ofthe movie clips, in the example clip 152-4, may be replaced byadvertisement clips, in the example by clip 152-4, where e.g.advertisement is displayed as overlay.

Adding additional clips is of course also possible as shown in FIG. 7D.As seen, playlist 157-B references, by a PlayItem 155, a clip 152-7. Asindicated by the arrows, playlist 157-B will lead to subsequent playbackof the clips as follows: 152-1, 152-2, 152-3, 152-4, 152-7, 152-5, and152-6.

Clip 152-7 may include advertisements (e.g. a commercial). Thus, e.g. amovie will be reproduced with commercial breaks.

The embodiment of FIG. 7D could be used as follows: All of the fakeplaylists (further first orders) on a disc may in fact allowreproduction of the genuine AV content (AV data) in the genuine playbacksequence. However, all or the majority of the fake playlists may includereferences to clips with advertisements as e.g. clip 152-7 in FIG. 7D.This way, if a copy is made, the movie may always be played back in thecorrect order but with commercial breaks unless the correct playlist(first order) is known or can be derived as explained.

FIG. 8 shows a further embodiment where a feature of the Blu-raystandard/specification referred to as “multi-angle” is applied.

The Blu-ray standard allows for some portions of a title (movie) to beplayed back in multiple angles which may be chosen by the user or may beset by a BD-J object or Movie object.

According to the embodiment of FIG. 8, a technique may be employed thatis similar to the copy protection with multiple playlists. A BD-J objector Movie object may be inserted that checks for the original disc duringplayback. If the disc check succeeds, i.e. a disc is deemed to be anoriginal disc, then a register is set which will lead to playback of thecorrect angle, i.e. the correct angle of a part of the original AV datais selected. If, however, the check fails, the register may be setdifferently, e.g. such that another angle (fake angle) will be playedback. This other angle may reference a clip with arbitrary AV content.

Thus, the “fake angle” may contain arbitrary audiovisual content. Thecorrect angle may contain the correct sequence (portion) from the mainmovie (AV data), whereas fake angles may contain corrupted versions, anempty video, advertising clips, or a copy barrier for example. This isillustrated in FIG. 8. As shown, there is additional clip#2-2 stored onthe disc. This additional clip#2-2 corresponds to “arbitrary”audiovisual content, i.e. non-desired content that distracts the userand/or reduces the entertainment value when played instead of theoriginal clip#2-1 that corresponds to a part of the original AV data.Also, reading of the disc may be disturbed/aborted if the clip#2-2included a copy barrier.

In a further embodiment shown in FIG. 9, a record carrier 154, e.g. aBlu-ray disc, does not have a playlist stored thereon. Additionallyand/or alternatively the record carrier 154 may not include all slicedportions of the original AV data.

Since no playlist is provided on the record carrier 154, the recordcarrier 154 will not playback in a player 156 if the player requires aplaylist for playback of the AV files stored on the record carrier 154.Thus, if a copier makes a copy of record carrier 154, the copy might becompletely useless since it does not contain a playlist, i.e. theplaylist is missing. If there is no way for the player to determine theplaylist e.g. by downloading it from a server 158 or accessing it from aremovable storage media, the copy is useless. Moreover, if the recordcarrier 154 comprises sliced AV files of e.g. one minute length, andthese sliced AV files are stored on the record carrier 154 in ascrambled (second) order as explained, it will be even more difficultfor a copier to reproduce the genuine AV file in the (correct) genuineplayback sequence as created by the director or moviemaker of the videocontent.

As already indicated, there is also an embodiment possible where therecord carrier 154 does not comprise all AV portions in order tocompletely reproduce the AV data. In other words, after slicing the AVdata into a plurality of portions as explained above, at least one ofthe portions might not be included/stored on record carrier 154. Ofcourse it is possible to select this missing portion such that themissing portion might e.g. contain a key scene of a movie (a part of theAV data that is important for a viewer to logically understand thecontent of the AV data). Thus, a copy of such a record carrier 154without some of the portions of the AV data, e.g. a key scene of amovie, will have a severely reduced entertainment value for a viewersince he might be missing important portions of content of the AV data,e.g. the movie.

In order to playback a record carrier 154 without a playlist and/orwithout all AV portions necessary to completely reproduce the genuine AVfile, a player 156 may download the playlist and/or additional/missingAV files from a server 158. Alternatively, the player may also read theplaylist and/or additional/missing AV files from a removable or fixedstorage media that can be inserted/removed into/from player 156.

In either case, the distribution of the (missing) playlist and/oradditional/missing AV files may be done independently from distributingthe record carrier 154.

Of course, a download may require that an original disc check performedon player 156 be successful. In other words, only if player 156determines that an inserted record carrier is an original record carrier(e.g. pre-recorded record carrier), the player 156 will be able todownload the correct playlist and/or additional AV files. If theoriginal disc check fails, the server may still provide a playlist oradditional files. However, the provided playlist may be a fake playlistas detailed above. Also, the provided additional files may compriseadvertisement.

As mentioned, the AV files downloaded from the server might be smallslices, i.e. portions, of the genuine AV file. These slices may have alength of e.g. one minute, two minutes, three minutes, five minutesand/or ten minutes. Thus, the sliced AV files are rather small in sizeand consequently only require little bandwidth when transmitted fromserver 158 to player 156. Thus, an effective copy protection with onlylittle bandwidth requirement may be realized.

Also, transmitting a playlist from the server 158 to player 156 requiresonly little bandwidth. Thus, also in an embodiment where all AV portionsare on the disc but no playlist is stored on the disc, an effective copyprotection with only little bandwidth requirement may be realized.

Thus, as shown in FIG. 9, there is an embodiment where at least one of aplurality of AV portions (sliced portions) is stored on server 158 andnot stored on the record carrier 154.

When downloading the playlist, it may also be possible that this is onlyadmitted if a hardware identifier of a playback device, e.g. a PCidentifier of a PC, used for downloading is transmitted to the serverfirst. For example, if a software player on a PC is used as playbackdevice as e.g. shown in FIG. 18, an installed native module couldtransmit the PC identifier to the server.

It is also possible that the record carrier 154 comprises a playlist,however, this playlist may not be the correct one, i.e. it does notallow playback in the genuine playback sequence and/or genuine quality.Playback with the playlist stored on the disc might lead todissatisfying reproduction of the genuine AV file. It is also possiblethat record carrier 154 comprises AV files with advertisements. In thiscase, a playlist stored on the record carrier 154 may reference such AVfiles comprising advertisements. Moreover, there may be provided aplaylist on record carrier 154 allowing reproduction of content, e.g. amovie, in the genuine playback sequence, however, interrupted byadvertisements (commercial breaks). In order to enjoy the content(movie) without advertisements, another playlist might be necessary.This playlist may be provided by server 158 once player 156 determinedan inserted record carrier to be an original record carrier and not acopy.

Such an embodiment may in fact impose less restrictions on allowingcopies of the record carriers including the advertisements since amanufacturer of a record carrier might have an income (revenue) from theadvertisements stored on the record carrier. However, in order to avoidthat a copier simply removes the advertisements, it may be useful todivide/slice and shuffle as described above.

In the context of a Blu-ray disc, the feature that might be used torealize an embodiment as shown in FIG. 9 is what is referred to as“progressive playlist”. This BD-ROM feature makes it possible to play aplaylist with streaming-like playback, i.e. downloading stream data froma website. Thus, not all clip AV streams from a progressive playlisthave to be available before playback begins. Thus, the playback of aplaylist may start and the correct additional data is downloaded orextracted from the disc only if the original disc check at the playersucceeds. If the disc check falls, the additional data that is eitherprovided from the disc or from the server may be junk data, completelymissing and/or advertising content. Also, non-reproducible content thatwill cause a player to stop playback may be provided from the server.Downloading content from a website may require a BD-ROM player with BDprofile 2.0 or BD profile 2.x. In order to combine the downloadedcontent in the local storage (or from the disc extracted content) withcontent from the record carrier, the VFS (virtual file system) needs tobe used (VFS update).

The virtual file system and progressive playlists may be used to startthe playback of the correct downloaded additional data only if theoriginal disc succeeds. Additionally, the pre-recorded media serialnumber (PMSN) may be used for downloading individual, unique content forevery disc (e.g. automatically generated). The PMSN is a unique serialnumber which can be added to each BD-ROM, e.g. for online authenticationfor managed copy.

Thus, it is possible to download a unique playlist for each individualdisc.

This feature may be advantageously used in an embodiment where at leasta part of the AV portions of the AV data are watermarked. Thus, adownloaded unique playlist may be used for watermarking purposes as e.g.shown in FIG. 10A.

As shown in the embodiment of FIG. 10A, a record carrier 160 maycomprise a plurality of AV portions 1₁, 1₂, 2₁, 2₂, 3₁, 4₁, 5₁, 5₂, 6₁,7₁, . . . .

In this notation, the index “1” denotes an AV portion without awatermark and the index “2” denotes an AV portion with watermark. Forexample, AV portion 1, is an AV portion without a watermark and AVportion 1₂ comprises the same AV content as AV portion 1, but with awatermark. Thus, AV portion may be referred to as an “original” AVportion and AV portion 1₂ may be referred to as a copy of the originalAV portion 1 ₁ with a watermark. It may be possible that all of the AVportions stored on record carrier 160 exist in two instances, in oneinstance with a watermark and in one instance without a watermark.However, as seen in FIG. 10A, this is not necessary. On record carrier160 only AV portions 1, 2, and 5 are stored twice, i.e. ones without awatermark and ones with a watermark.

Note that on record carrier 160, the AV portions 1₁, 1₂, 2₁, 2₂, 3₁, 4₁,5₁, 5₂, 6₁, 7₁, . . . may be (physically) stored in a scrambled order asexplained above. This, however, is not necessary. However, it may beadvantageous in that it prevents easily copying the content.

By providing originals and copies with watermarks of AV portions onrecord carrier 160 it is possible to create playlists where a copy witha watermark is played/reproduced instead of the original AV portion.Moreover, it is possible to define a plurality of “correct” playliststhat all allow reproducing the AV portions such that the content isreproduced in the genuine playback sequence. In other words, there mayexist a plurality of first orders that all allow reproducing the contentin the genuine playback sequence.

This is illustrated in the table depicted inside server 162 in FIG. 10A.Note that the usage of a plurality of “correct” playlists in aserver/player environment is not necessary. It may also be possible toprovide the plurality of “correct” playlists on record carrier 160 andselect one of the playlists depending on characteristic parameters (i.e.a key) extracted from the disc.

As seen in the table depicted inside server 162, there are for examplethe following three playlists possible that are all correct, i.e. allowreproduction of the genuine playback sequence:

-   -   3₁1₁5₁2₁6₁4₁    -   3₁1₂5₁2₁6₁4₁    -   3₁1₂5₁2₂6₁4₁

All of these three playlists 1-3 are “correct” playlists that willplayback the content of the AV data in the genuine playback sequence.However, since some of the AV portions comprise a watermark, it ispossible to identify the playlist that has been used when reproducingthe genuine content. For example, if the AV portions 3₁1₁5₁2₁6₁4₁ arereproduced, then the first playlist was used.

By using this concept of using original AV portions and watermarkedcopies for playback and due to the fact that the AV portions are rathersmall in size, it is easily possible to create a very large number of“correct playlists”. The number of possible correct playlists growsexponentially with the number of pairs of copies/originals of AVportions. Under the assumption that no further copies of AV portions arestored on record carrier 160, it would be possible to create 2³=8different correct playlists since there are three pairs of original/copyof AV portions.

The idea of using pairs of copy/original of AV portions may be exploredin various ways. As already indicated, it may be possible to store alarger number of correct playlists on the record carrier. Then, theplaylist that will be selected during playback may depend on acharacteristic value extracted from record carrier 160. For example, thepre-recorded media serial number (PMSN) may be used as a characteristicvalue. However, any kind of key as explained above and below might beused for determining a playlist that will be used for playback. Thus, inthis embodiment it will be possible to determine by analyzing thereproduced content which unique record carrier was used for playback.

It is also possible that no correct playlist is stored on the recordcarrier 160 and the different “correct” playlists be stored on server162. When the record carrier 160 is inserted in a player 164, the playermay perform an original disc check as explained above. Once the playerhas determined that it is an original disc, the player may transmit aunique identifier of record carrier 160 to server 162. A uniqueidentifier might e.g. be the PMSN of a Blu-ray disc. In the embodimentof FIG. 10A the PMSN of record carrier 160 is e.g. PMSN=52789. At server162, this PMSN may be assigned to a yet not assigned/used playlist. Inthe example of FIG. 10A, playlist 3: 3₁1₂5₁2₂6₁4₁ is assigned toPMSN=52789 of record carrier 160. Then, the server 162 may transmit thisplaylist 3 to the player 164. Consequently, the player 164 reads/playsback the audio video portions 3₁1₂5₁2₂6₁4₁.

In case player 164 is used for making a copy of record carrier 160, forexample by ripping the content, the ripped content may still comprisethe watermarked portions. When the ripped content is analyzed theanalysis might reveal the following:

3₁ original AV portion 1₂ watermarked copy of AV portion 5₁ original AVportion 2₂ watermarked copy of AV portion 6₁ original AV portion 4₁original AV portion

Thus, the analysis revealed a certain order of AV portions that areeither a copy or an original AV portion. Based on this analysis it ispossible to determine the playlist that has been used when reproducingthe original disc. Since the playlist is uniquely associated with aPMSN, it will be possible to derive the PMSN from the ripped content.

Thus, this embodiment may help to track down a disc from which a copyhas been made. This may be advantageous to find copiers. For example, ifit was known where a certain disc has been sold or rented, astore/renting location might be spotted. Moreover, if the store orrenting location has a customer database it might be even possible tolocate who has rented/bought a record carrier 160. Of course, legalregulations regarding such storing of customer data will have to beobserved. Nevertheless, it may e.g. be possible to determinestores/renting locations where frequently discs are rented from whichcopies show up e.g. on the internet or on the blackmarket.

FIG. 10B shows an embodiment that is similar to that of FIG. 10A.However, in this embodiment more than one copy of an AV portion existsfor some of the portions. For example, there are two copies of portion 2and 5. Thus, there are three instances for portions 2 and 5, twoinstances of portion 1 and only one instance of portions 3, 4, 6, and 7.Thus, as seen in FIG. 10B there may be a predetermined number ofinstances of sliced portions. Each of the instances may be watermarkedwith a different watermark. In this case, it should be noted that thisis of course likewise possible in the embodiment of FIG. 10A. In fact aportion explained to be an “original with no watermark” in FIG. 10A, mayalso be seen as an instance of the respective portion with a “watermark”that is equal to “zero” (thus the possibility of “no watermark” is seenas a special case of a watermark).

In the example of FIG. 10B, each instance is assumed to have awatermark. Note again that the case of “no watermark” is treated in thesame manner. i.e. an instance having no watermark may also be seen ashaving a watermark “zero”. For example, if there is only one instance ofa portion, it may be computationally more efficient to not provide areal watermark for the respective portion.

It is evident from FIG. 10B how the extended concept with respect to theembodiment of FIG. 10A may be used: In the example, Playlist 3 containsthe sequence of instances of portions:

3₁1₂5₁2₃6₁4₁

If this sequence of portions/instances is used for playback, this can,in the same manner as explained above in FIG. 10A, be used to determinethe playlist that has been used when reproducing the original disc. Inthe example of FIG. 10B, as in FIG. 10A, playlist 3 had been used.

FIG. 11 further illustrates the example of FIG. 10A. As seen,watermarking using unique playlists n different clips are used for thePlayItems 1₁-6₁. Every permutation of the PlayItems X₁ can be used, onlythe position X in the playlist may be fixed (this is not necessary).

FIG. 12 shows a further embodiment where on a record carrier 166 programinstructions 170 and encryption parameters 172 are stored.

Thus, a method for copy protection is provided where at S170 shown inFIG. 12, program instructions are stored on the record carrier. When therecord carrier 166 is played back on a playback device 168, then, asindicated at S172, the program instructions 170 are loaded from recordcarrier 166 and executed on playback device 168. When the programinstructions 170 are executed, the playback device 168 checks, in afirst step S174, if the encryption parameters 172 are at all stored onthe record carrier 166. If this is the case, then, in a second stepS176, the integrity of the encryption parameters is checked. Only ifthis check succeeds, then at S178 playback is possible in genuinequality. Otherwise, at S180, there will be no playback or there will beplayback with a reduced entertainment value due to a deterioratedquality, i.e. playback that is not in genuine quality.

The encryption parameters 172 may depend on genuine audiovisual contentstored on the optical record carrier and may have been determined inaccordance with an encryption standard for copy protection of thegenuine audiovisual content stored on record carrier 166 at the time ofmanufacturing the optical record carrier.

For example, the encryption parameters 172 in case of an original recordcarrier 166 may be AACS (advanced access content system) parameters.When copiers make a copy of an original record carrier, often the AACSfolder is completely removed. Thus, at S174 this would result in that noplayback is possible at S180 or playback is with reduced entertainmentvalue. On the other hand, if a copier makes a copy and aims at copyingthe AACS parameters, then an integrity check as defined in the AACSspecification which is hereby incorporated by reference may not besuccessful. In other words, the integrity check at S176 might not besuccessful so that playback is prevented or playback is with reducedquality at S180. More precisely, the entire contents of the documentAdvanced Access Content System (AACS) “Introduction and CommonEncryption Elements”, Revision 0.91, Feb. 17, 2006, available from theAACS LA web site, www.aacsla.com, is herewith incorporated by referencein its entirety. Also, the entire contents of the document AdvancedAccess Content System (AACS) “Pre-recorded Video Book”, Revision 0.92,Nov. 29, 2007, available from the AACS LA web site, www.aacsla.com, isherewith incorporated by reference in its entirety. Moreover, the entirecontents of the document Advanced Access Content System (AACS) “Blu-rayDisc Pre-recorded Book”, Revision 0.921, Jun. 6, 2008, available fromthe AACS LA web site, www.aacsla.com, is herewith incorporated byreference in its entirety. Still further, the entire contents of JavaDocincluded in “JavaDoc and Stubs for BD Prerecorded Book”, Rev. 0.921,available from the AACS LA web site, www.aacsla.com, seehttp://www.aacsla.com/specifications/Supplement_BD_Prerecorded_Book_v0.921.zip,is herewith incorporated by reference in its entirety.

The program instructions 170 may correspond to program instructions thatare also stored on player 168 for checking the encryption parameters172. Thus, the program instructions 170 stored on the record carrier 166may allow to do checks that are usually only done in the hardwareenvironment by the playback device to be emulated in software and loadedfrom the record carrier. For example, if the record carrier is playedback by a licensed hardware player, the same checks regarding theintegrity of the encryption parameters may be done twice: once by thehardware of the player and once in software by the player, e.g. in aJava virtual machine (JVM) running on the player executing the programinstructions 170 loaded from the record carrier 166.

For example if the record carrier 166 is an original Blu-ray disc andthe player 168 is a licensed BD player, the player will check the AACSparameters as defined in the aforementioned specification of AACS. Thisis mandatory for a licensed hardware player. The program instructions170 essentially perform the same checks in software (or at least a partof the checks). Thus, the integrity of the AACS parameters might bechecked twice: once by the hardware of player and once in software bythe player 168 after having loaded and executed the program instructions170.

Thus, by providing the program instructions 170 on record carrier 166,an original disc check in software run on a player 168 might berealized.

If the record carrier 166 is a Blu-ray disc, the program instructions170 may be embedded in a BD-J object. This BD-J object may have furtherfunctions such as e.g. controlling of the playback of the audiovisualcontent and/or an interactive user menu for controlling playback of theaudiovisual content. Thus, some portions of the program instructions 170may be related to checking the encryption parameters 172 and otherportions may be related to other functions according to the Blu-raystandard such as e.g. controlling of playback and menus and/or otherfunctions according to the Blu-ray standard, e.g. user interactioncommands, navigation commands and the like.

In a further embodiment, the program instructions 170 might alsocomprise instructions for discriminating a correct playlist from aplurality of fake playlists as explained above. If further the recordcarrier 166 contained sliced and shuffled AV portions as explainedabove, the program instructions, e.g. BD-J object, might not be removedfrom a copier of record carrier 160. The reason is that if the copierwas to remove the program instructions, then it may not be possible todetermine the correct playlist. Also, the program instructions mightprevent playback. Thus, there is a dilemma for a copier since if heremoves the program instructions 170, it will not be possible todetermine the correct playlist. On the other hand, if he leaves theprogram instructions 170 on the copy, the program instructions mayprohibit playback of content on the optical record carrier 166.

As mentioned, if the record carrier 166 is a Blu-ray disc, then a disccheck may be performed in a BD-J object. This may fail for a copy. Then,the BD-J object may trigger an appropriate action, if it cannot detectthe original disc. This action can be freely defined ranging from thedisplay of an error message to the playback of anti-piracy oradvertising content to the playback of one of the fake, advertisementplaylists, playback forced fake subtitles of playback forced fake audiostreams. Thus, there is playback with a reduced entertainment value andnot in genuine quality. Further, actions during playback, e.g. buttonnavigation commands in the interactive graphics IG stream may beapplied, too.

In case of fake playlists, fake titles, fake angles, and/or fakesub-paths as throughout this specification, the key to decrypt(determine) the information which playlist/title/angle register/sub-pathis the correct one might also be based on unique properties of theoriginal Blu-ray disc which cannot be transferred to an illegal copy ofan original disc having data stamped onto it. This measure providesanother layer of security: a BD-J object on the illegal copy will not beable to extract the key to find the correct playlist from the disc. Thisis illustrated in FIG. 13. The BD-J object 184 stored on the copied disc182 which is an illegal copy will check the disc at S186 after havingextracted a key at S188. Since the extracted key (e.g. encryptioncharacteristics/parameters, checked encryption parameters and/or thelike) is not correct, the correct playlist cannot be determined. Thus,the player will not know which is the correct movie playlist and whichones are fake movie playlists. Note that the example in FIG. 13 showsonly a plurality of playlists (including the fake and correctplaylists). Of course, it is likewise possible to extend this to faketitles, angles, and/or sub-paths as explained herein.

In the embodiment of FIG. 13, the BD-J object is loaded from the disc.In another embodiment, the BD-J object may also be loaded from the localmemory (VFS). The BD-J object may be transferred to the local memory bydownloading it from the Internet or by extracting it from the encodedcontent (see embodiment of FIG. 20).

Generally, as seen in FIG. 14, another approach to create an illegalcopy is transferring the audiovisual data of a record carrier to a harddisc drive (a procedure commonly refer to as “ripping”). This data maythen be played back, re-encoded into a different format, e.g. alsosmaller in size, for distribution on the Internet or burned to arecordable disc. The clip slicing explained above ensures that thecopies created by ripping are not usable. Such a copy will be completelyunsuited for viewing. This is illustrated in FIG. 14: Due to the slicingand shuffling of clips the audiovisual data that can be extracted fromthe disc is not enjoyable (unusable). An attempt at playback will leadto a succession of interleaved, unconnected movie fragments.

If chunk or advertisement clips have been inserted, the situation issimilar. After ripping such clips from an integral part of the rippedcontent not only is the playback garbled, it also features advertisementcontent.

As already explained at hand of FIG. 12, it is possible that programinstructions are stored on a record carrier that when executed checkwhether encryption parameters exist on a record carrier and also checkthe integrity of such encryption parameters. This is explained in moredetail at hand of FIG. 15. According to this embodiment playback mayonly be allowed in genuine quality if AACS specific files (encryptionparameters) and properties (integrity check of AACS parameters) exist(first step S174 in FIG. 12) and if the AACS parameters are not modified(second step S176 in FIG. 12). Therefore, licensed players (CE or SW)may not play illegal decrypted contents. Rip tools may e.g. remove theAACS folder completely and decrypt the AV stream files with the titlekey they can calculate from a broken AACS version (MKB-media key block)and sniffing the volume ID (or with BD drives with patched/modifiedfirmware). As explained at hand of FIG. 12, a method for copy protectionmay check if AACS has been removed in step S174 and prevents playback ifAACS specific attributes cannot be found in the second step S176.

FIG. 15 shows the file structure of a Blu-ray disc. The AACS folder 190holds a content certificate 191 per layer (content000.cer for layer 0,content001.cer for layer 1, . . . ). These content certificate filescontain data that a licensed player has to validate during the startupof the disc (e.g. content hashes, hash value of the BD-J rootcertificate, AACS LA RSA signature, i.e. if the AACS folder 190 exists,the files, e.g. the content certificate file 191 has to becorrect/unmodified to do playback of encrypted content. Beforereplication of BD-ROM discs can start, these files have to betransferred to AACS LA for adding their signature.

As mentioned above, for copy control purposes, the player may performintegrity checking in hardware. However, it is also possible to do theintegrity check in software additionally or alternatively. Thus,integrity checking that is usually done in hardware by a licensed playermay also be done in software in a BD-J object. In order to circumventthis integrity check the whole BD-J object (or playback title) wouldhave to be removed or hacked. However, as apparent from the aboveexplanation, there are means to prevent such circumvention/hacking. Forexample, the slicing (splitting) of the main movie file into a pluralityof sliced AV portions, i.e. multiple small chunks, and obfuscating theplayback instructions (sequence of connecting video fragments) asdescribed above.

In other words, the BD-J object for finding the correct playlist may notbe simply removed. If in the same BD-J object the integrity check isdone, then a copy without encryption parameters, e.g. AACS parameters,or modified encryption parameters, may lead to a playback with a fakeplaylist. The AACS parameters may, thus, be used as “key material”, i.e.input data for the BD-J object to discriminate the correct and fake(false) playlists.

The integrity checks that may be done in case of AACS encrypted contenton a Blu-ray disc may be explained at hand of FIG. 15. A BD-J object 193that is stored on the record carrier (program instructions as e.g.denoted by reference sign 170 in FIG. 12) references a *jar file (Xlet)192 which is launched when the BD-J object is selected during playback.The Xlet 192 opens the content certificate file 191 (e.g. content000.cerwhich exists on any BD-ROM independently of the number of layers,exemplary explored/depicted on the right hand side of FIG. 15) and readsa Hash_Value_of_BD-J_Root_Certificate item 194. This value 194 iscompared with the calculated SHA-1 (SHA=secure hash algorithm) value ofthe app.discroot.crt file 196 and need to be identical. Theapp.discroot.crt file 196 may also, in a more general term, referred toas “application root certificate” and/or as “root certificate of a BD-Japplication authentication”. Similar tasks can be done with theencrypted AV content itself. Hashing, therefore, is done in a 2-step waywhereby hashes of AV chunks (not to be confused with the above-definedslices) are stored in the content hash table 198 (e.g.ContentHash000.tbl, which exists on any BD-ROM independently of thenumber of layers). The hash value of chunks of the content hash table isstored in the content certificate file 191 and referenced with referencesign 200 in FIG. 15. This value can be compared and needs to beidentical to the calculated hash value of the corresponding chunk of theAV stream file 202.

Additionally and/or alternatively to checking, when executing theprogram instructions on a player, the content of the AACS folder asdescribed at hand of FIG. 15, it is also possible to check the contentof a BDMV/stream folder as will be explained at hand of FIG. 16.

For example, checking the CPI flags (copy permission indicator) in theAV stream files (clip files, highest order 2 bit of TP_extra_header)hinder the ripping tools to do decryption of the content files.Additionally, checking if content is encrypted can be done by checkingthe value of the sync_byte of the transport stream (every TS packetstarts with the value 0x47), if encrypted this value changes.

As seen in FIG. 16, the BDAV transport streams 220 (*.m2ts AV clipfiles) are composed of aligned units 222-1, . . . , 222-n each 6144bytes in size (3 logical sectors of 2048 bytes). An aligned unit 222again is split in 32 source packets 224-1, 224-2, . . . , 224-32 each192 bytes in size. A source packet 224 itself consists of a 4 byteTP_extra_header 226 (4 bytes in size) and the transport packet 228 (188bytes in size). The layout of the transport packet 228 corresponds tothe standard MPEG-2 system portion 1 specification (ISO/IEC 13818-1).The most significant 2 bits of the TP_extra_header 226, thecopy_permission_indicator 230 signals an encrypted BDAV transport streamif they are set to the binary value of 11b. Checking this valueguarantees that the AV clip files have not been decrypted. In otherwords, the copy_permission_indicator 230 may be referred to as anencryption parameter and if this value indicates the binary value of11b, then this encryption parameter may be judged to be in integrity.

Each transport packet 228 starts with the 8 bit sync_byte 232 with avalue of 0x47 hexadecimal. The first 16 bytes of an aligned unit are notencrypted (unencrypted) and the rest of 6128 bytes is encrypted usingthe block key and AES-128CBCE encryption as specified for AACS—detailscan be found in the AACS BD pre-recorded book available at the aboveindicated webpage. Starting with the second sync_byte 234 of an alignedunit this value is encrypted (typically not 0x47) and can be checked toguarantee that the AV clip file is still encrypted.

Thus, the second sync byte 234 of an aligned unit may be referred to asan encryption parameter and it can be checked whether this encryptionparameter is in integrity, i.e. if it is not 0x47 it may be inintegrity. In order to achieve a better reliability of the integritycheck, a predetermined number of e.g. 5 consecutive sync_bytes might bechecked. If the majority of these checked sync_bytes are different fromthe value of 0x47, then integrity of this encryption parameter might beassumed.

In still another embodiment, which is depicted in FIG. 17, the existenceof a volume ID and/or a PMSN on a Blu-ray disc might be checked. Thevolume ID and PMSN might also be referred to as encryption parametersand it may be checked if these encryption parameters are present on aBlu-ray disc. If they are not present, then, as e.g. depicted at S180 inFIG. 12, playback may be prevented or playback may be with reducedquality.

Regarding the embodiment of FIG. 17, it should be noted that the AACSAES decryption needs 2 parts of key material which is on the one handthe processing key which is a result of processing the MKB (media keyblock) file on the disc (MKB_RO.inf file in the AACS folder) with theunique device keys of the player and on the other hand the volume IDwhich is stored in the ROM mark of the BD-ROM.

The PMSN (pre-recorded media serial number) is a unique serial which canbe added to each BD-ROM, e.g. for online authentication for managedcopy. AACS LA provides an interface to get access to the volume ID andPMSN from a BD-J object. Illegal copying or ripping a BD-ROM leads to aloss of volume ID and PMSN which can be checked to guarantee to have anoriginal disc. In other words, if the volume ID and/or PMSN (encryptionparameters) do not exist a disc is an illegal copy.

In FIG. 17, reference sign 236 symbolizes a BD-ROM with a BD-J object238 including program instructions that check the existence of thevolume ID 240 (within the ROM mark of the disc) and the PMSN 242 (withinthe BCA “burst cutting area”, area of the disc). Reference sign 244denotes a Java™ program fragment that is associated with the BD-J object238. The program fragment 244 (program instructions) may check theVolume ID 240 and/or PMSN 242 via the com.aacsla.bluray.online package.At 246 a flowchart is shown running through different checks to decideif the disc is an original or not. Therefore, at S248, the volume ID isread. If it is invalid, the disc, at S250 is determined to be a copy.Further, at S252, the PMSN is read. If the PMSN is not valid, then theprocess goes to S250 and determines that the disc is a copy. If thevolume ID at S248 and PMSN at S252 have been determined to be valid, atS254, a player may go online to a server. This is possible if a Blu-rayplayer has an interconnectivity which is mandatory for Blu-ray playerswith profile 2.0. At S256, the server may verify the value of the PMSN.If it is accepted, at S258 it is determined that the disc is anoriginal. On the other hand, if the PMSN is not accepted by the server,at S258 it is determined that the disc is a copy.

FIG. 18 shows a further embodiment of a Blu-ray disc 260 comprising aBD-J object 262 (program instructions). In the example shown in FIG. 18,the Blu-ray disc 260 is played back on a host environment 264, e.g. acomputer environment such as a personal computer. In the hostenvironment 264, there may be provided a software such as a Blu-ray discsoftware player 266. For playing back Blu-ray disc 260, the BD player266 may run a Java virtual machine (JVM) 268. The Java virtual machine268 may execute the BD object 262 when playing back the disc 260.

Further, the BD object 262 may comprise program instructions thatcomprise a check of the playback environment, e.g. the BD player 268. Ifthis check reveals that the playback device is a computer, i.e. the hostenvironment 264 indicates that it is a computer, the BD-J object 262 mayprevent playback unless further software such as a native module 270 isinstalled in the host environment 264. Alternatively, playback may bestarted, however, not with the correct playlist, correct title, correctangle settings, and/or correct sub-paths. Thus, in the embodiment shownin FIG. 18, the host integrity (and the disc integrity: original vs.illegal copy) may influence the selection of the correct playlist,correct title, correct angle settings, and/or correct sub-paths amongthe possible plurality of respective fake playlists, fake titles, fakeangle settings, and/or fake sub-paths.

The native module 270 may be provided by a manufacturer of the Blu-raydisc 260 and/or by a provider of the software BD player 266.

Within the native module 270, the host integrity of the host environment264 may be checked. For example, it may be checked whether the BD player266 is not running in a debug mode. If the BD player 266 is running in adebug mode, then the native module 270 may be able to detect this andreport this to the Java virtual machine 268. In turn, the Java VM 268may not allow playback of the Blu-ray disc 260. Also, within the nativemodule 270, the original disc check may be performed or determined incooperation with the BD-J object.

The installation of a native module 270 may have several advantages:first, the programming within the native module 270 may be moresophisticated than the programming that is possible in a BD-J object.The native module 270 may also comprise program instructions to performthe original disc check as explained above, however, in a moresophisticated way. This is possible since the host system may have lessrestrictions regarding e.g. code size, used/free memory size,performance, and so on. Better obfuscation may be possible in the nativemodule 270 than if only using Java code. This is possible, since in thenative module, e.g. the x86 instruction set may be used for which morepowerful obfuscation can be applied than for Java byte code.“Obfuscation” may e.g. refer to hiding how a correct playlist may bedetermined. Further, the BD-J object 262 and the native module 270 maydo the original disc check and host integrity check in combination.

The BD-J object 262 may communicate with the native module 270 via aconnection, e.g. a TCP/IP connection via the local host. The connectioncould thereby be encrypted so that hackers may not easily eavesdrop thedata exchanged between the BD-J object 262 and the native module 270.

In order for the BD-J object 262 to verify that a native module is atall installed on the host, the BD-J object 262 may e.g. send a requestto a predetermined port of the local host (IP address: 127.0.0.1). Thenative module could be configured to use this port and, thus, if thenative module is installed on the host, then the request may beappropriately answered, i.e. answered in an expected (predetermined)manner. If the request is answered as expected, the BD-J object 262 mayjudge that the native module is appropriately installed and may startcommunication. In this case, playback of the genuine content may bepossible (provided that the disc is an original or a legal, e.g.managed, copy). If the request is not answered or not answered asexpected, the BD-J object may initiated display of a message to the userto install the native module e.g. by already indicating a certain webaddress for download. In this case, playback in the correct (first)order of the sliced and shuffled portions may be prevented unless thenative module is installed (and playback is restarted after installationof the native module). Also, a playlist with advertisings (see above)may be selected unless the native module is installed.

In case of BD profile 2.0, the BD-J object could also download thenative module.

Also, the native module 270 allows checking the integrity of the hostenvironment 264. This would not be possible by using the BD-J object 262alone, i.e. without interaction with the native module 270. The reasonis that if the BD-J object was used without the interaction with thenative module 270, it would be run in a Blu-ray Java VM without beingable to access the host environment.

The native module 270 may also control the host environment so that itis not statically or dynamically modified/corrupted/influenced to allowplayback from a pirated (illegal) copy. The native module 270 may e.g.check the integrity of the playback software via checksums or check thatit is not running in a debugging mode where data could beinspected/modified from outside. It can also check that the Blu-ray discis not an emulated virtual drive like it is able with virtual drivesoftware. The native module 270 may also make sure that no capturing ofvideo content is done during playback of the Blu-ray disc.

One further advantage of the native module 270 may be explained at handof the following example: It may be expected that copiers will try todetermine the correct playlist (correct first order) for playback ofsliced AV portions that may be stored on the Blu-ray disc 260 by runninga BD software player 266 in a debug mode. In such a debug mode(indicating a “suspicious” host integrity=non-verified host integrity)it might be possible to determine the correct playlist of the pluralityof AV portions stored in the second order by tracking a physical accessorder of files on a disc. In that the BD-J object 262 requires thenative module 270 to be installed, it can be prevented that the BDsoftware player 266 be run in a debug mode.

If the disc is played back on a hardware BD player, this might beverified by the BD-J object 262. In that case, of course, the BD-Jobject 262 will not require that a native object be installed in orderfor playback. On the other hand, the BD-J object 262 may of course,still verify that the disc is an original or a legal copy based on theextracted “key material” as explained throughout this specification.

FIG. 18 also shows a circumvention module 271 as an example of a way fora hacker to hack the copy protection. In FIG. 18, dashed lines indicatea communication between the two entities connected with such a dashedline. A solid line indicates a “monitoring” or “surveillance”. Forexample, the native module 270 is depicted as “monitoring” the hostenvironment for a circumvention module (detection if such acircumvention modules is installed or running). Likewise, thecircumvention module would, if installed and running, monitor the discand/or the BD player. For example, the circumvention module could be orrealize: a debug tool (single stepping, API hooking, memory sniffing), aTCP/IP monitor, a file monitor (e.g. detecting which file(s) on the discare accessed in which order), a bus monitor (e.g. detecting whichsectors on the disc are being accessed in which order), installed filterdrivers, a wide range of emulators (e.g. emulating that AACS and/or aVolume ID/PMSN exist on the disc), a virtual drive, an emulator for anoperating system (virtual machine).

The native module 270 may either be installed with a BD player software,i.e. the software for BD player 266 (full or update installation), or berequested by the BD-J object 262. For example, the BD-J object 262 maydetect that the playback is started on a software BD player and not on alicensed hardware player. If the BD-J object detects that the BD player266 is a software player, the BD-J object may show an Internet addressin a video frame where the user could download the native module 270 andinstall it on the host system 265. The host system 264 may e.g. be anoperating system such as Microsoft™ Windows™. Generally, it is desirableto have full cooperation with all manufacturers of software-based BDplayers. In case of such a cooperation, the software-based BD playercould already include or install the native module. However, it wouldalso work without such a cooperation with the consequence of lessconsumer comfort. The user may then have to download and install thenative module separately.

As soon as the native module 270 is running, if it is not startedautomatically by the BD player 266, it will be requested by the BDobject 262. The BD-J object 262 may communicate with the native moduleas mentioned above, e.g. via an encrypted TCP/IP connection.

FIGS. 19A to 19J show further embodiments where a copy protected recordcarrier comprises encrypted content, e.g. encrypted audio visual oraudio content. The record carrier also comprises program instructions(control logic) that is e.g. used for accessing the encrypted contentwhen the content is reproduced by a playback device. In the embodimentsof FIGS. 19A to 19J, the program instructions cause a playback device toread byte values at certain positions on the record carrier. The readbyte values are then interpreted as additional program instructionsand/or as input data to be further processed by the playback device.

FIG. 19A shows an exemplary embodiment. On the left hand side of FIG.19A, an optical record carrier 272-1 is depicted. Further, on the righthand side, a playback device 272-2 is schematically illustrated thatexecutes program instructions 272-3 stored on optical record carrier272-1. The program instructions 272-3 include a first portion 272-4 anda second portion 272-5.

Moreover, as illustratively depicted, in a first physical area 272-6,encrypted content is stored on optical record carrier 272-1. The programinstructions 272-3 are stored on optical record carrier 272-1 in asecond physical area 272-7. Note that although the second physical area272-7 is depicted as a box, in reality, this second physical area willin general also be circular in shape, the data being stored in a portionof the storage path of the optical record carrier 272-1.

In order to reproduce the content stored on the optical record carrier272-1, the playback device 272-2 will load and execute the programinstruction 272-3. When executing the first portion 272-4 of the programinstructions, the playback device will read byte values and/or bitvalues at certain positions within the first physical area 272-6. Thecertain positions could be predetermined positions or the certainpositions could be determined dynamically, e.g. depending on certainregister values or other program logic.

Throughout the description, all examples/embodiments relate to bytevalues. It should be understood, however, that also bit values could beused instead of byte values or in combination with byte values.

In the example of FIG. 19A, the playback device 272-2 has a memory272-8. In case the optical record carrier 272-1 is a Blu-ray disc andthe playback device 272-2 a Blu-ray player, memory 272-8 could e.g.correspond to the general purpose registers according to the Blu-rayspecification.

As illustrated, the first portion 272-4 comprises instructions to readbyte and/or bit values from positions A and B in the first physical area272-6. In other words, byte values from the encrypted content are read.The read byte values will then be stored in the memory 272-8. In theexample of FIG. 19A, the byte value at position A will be stored in amemory cell (register) 2176 and the byte value read from position B willbe stored in a memory cell (register) 2177.

The byte values which are read in this way may be seen as a data entityin memory 272-8. In the second portion 272-5, the data entity will befurther processed. For example, in the second portion 272-5, the dataentity might be interpreted as additional program instructions, e.g.Java byte code, and/or as input data to be further processed within thesecond portion, i.e. when the second portion is executed.

The data entity can be used in various ways as will be detailed below inconnection with FIGS. 19B to 19J.

In the example of FIG. 19A, an example for an interpretation of the dataentity as input data is shown. As seen, the second portion 272-5comprises an example of control flow statement

-   -   If (register 2176==0x0F) then X1 else X2

Thus, in this example the byte value stored in memory cell 2176 ofmemory 272-8 is used as input data for an if-statement. With such anif-statement or any other suitable statement for controlling the controlflow of software, the control flow within the second portion 272-5 ofthe program instructions may be influenced.

For example, if the if-statement is fulfilled, then a function X1 may beexecuted, whereas if the if-statement is not fulfilled, then a functionX2 may be called and executed (as exemplified in FIG. 19A).

The function X1 may e.g. correspond to a correct playlist (first order)in the sense as explained above. If the if-statement is not fulfilled,i.e. the function X2 will be executed, for example a fake playlist asexplained above could be used for further playback (further firstorder). Also, function X2 might lead to a different behavior of a menufor accessing the content stored on optical record carrier 272-1.Various other possibilities for function X2 exist. For example, aplaylist leading to playback of advertisements could be selected, amalfunctioning menu could be displayed, and/or playback could beprevented altogether. For further possibilities regarding behavior ofthe playback device 272-2 that will be annoying for the user, see aboveand below.

As should be clear from FIG. 19A, an advantage of using byte values ofthe encrypted content as input data/additional program instructions inthe second portion, is that these byte values will be different in casethe data stored in the first physical area 272-6 does not correspond toencrypted content. Thus, if a copier decrypts the content and stores thedecrypted content in the first physical area 272-6, the byte values atpositions A and B will be different then if encrypted content is storedin the first physical area 272-6. Thus, if a copier removes a copyprotection (encryption, e.g. AACS encryption in case of a Blu-ray disc),the byte values read into memory 272-8 during playback will be differentthan if the byte values are read at positions A and B from a prerecordedoptical record carrier or a legal copy thereof. Thus, the control flowcan be modified depending on whether the optical record carriercomprises encrypted content or decrypted content. The latter wouldindicate that the optical record carrier is an illegal copy. Thus, whenan illegal copy is played back, the program instructions stored on thedisc will result in a different behavior during playback and/orexecution of the program instructions (e.g. malfunctioning menu, etc.).

The positions A and B may also be referred to as “offsets”. For example,position A may be seen as offset of a certain number of bytes from thebeginning of a file or sector starting at the boundary (inner circle) offirst physical area 272-6.

Also, it should be noted that it is possible for the playback device272-2 to read not single positions, i.e. to not read the byte valuesposition-by-position (byte by byte) but instead to read into the memorya certain number of consecutive bytes, for example 1 megabyteconsecutively stored in the first physical area 272-6. In the playbackdevice 272-2, within the read larger portion, as mentioned e.g. 1megabyte, based on the offset values the bytes at the certain positionswill be read. For example assuming that the first physical area 272-6corresponds to 1 megabyte, this 1 megabyte might be read into the memoryof playback device 272-2 by one single reading access to the recordcarrier. In other words, all data of the physical area 272-6 might beread into the memory of the playback device consecutively. Then, withinthis data, the byte values will be determined based on the offsetinformation. This way, byte values at positions A and B may be readfaster than when accessing positions A and B separately.

FIG. 19B shows steps of a method for copy protection. At S272-9,encrypted content to be stored in the first physical area is determined.Further, at S272-10, the program instructions are determined which areto be stored in the second physical area. In case of manufacturing acopy protected record carrier, the content and program instructionswould be stored on the record carrier.

FIGS. 19C-1 and 19C-2 show examples of how the control flow in thesecond portion could be modified. The embodiments shown in FIGS. 19C-1and 19C-2 relate to the Blu-ray standard, i.e. it is assumed that theoptical record carrier is a Blu-ray disc. However, of course a personskilled in the art would have no difficulties to generalize theteachings to other standards.

As seen in FIG. 19C-1, at S273-1, it is checked whether the byte valuestored in register 2176 is equal to 0x0F. If this is the case processingproceeds to S273-2 where a procedure/command play (playlist) isexecuted. The playlist could e.g. correspond to a correct playlist(first order) that will start playback of the content stored on theBlu-ray disc, e.g. if the disc contains scrambled portions as explainedabove. However, the change of control flow can also be appliedindependent from the scrambling.

If the byte value stored in register 2176 is not equal to 0x0F, then theprocessing proceeds to S273-3. In the example of FIG. 19C-1, a menu willbe displayed in this case. Thus, FIG. 19C-1 shows how the control flowwhen executing the program instructions by a Blu-ray player is modifiedor influenced based on byte values read at certain positions within theencrypted content (the read byte values are interpreted as input data).

FIG. 19C-2 shows a further example where at S273-4 the byte value ofregister 2176 is evaluated. If the byte value corresponds to the bytevalue 0x0F, then a correct playlist PL will be used for playback atS273-5, i.e. a respective play command will be executed. The playcommands might be included in the second portion of the programinstructions shown in FIG. 19A.

If the byte value in register 2176 is not equal to 0x0F, then, atS273-6, a fake playlist “fake PL” will be used for playback by executinga command play (fake PL). The fake playlist could e.g. compriseadvertisings and/or result in a wrong order for playback.

Thus, in the embodiment of FIG. 19C-2, on the optical record carrier,the audio visual or audio content could be stored in a plurality ofportions (cf. e.g. FIG. 1).

As explained at hand of FIG. 1 above, the portions may have a firstorder, wherein when the portions are reproduced in the first order theaudio visual or audio content stored on the optical record carrier mightbe reproduced in a genuine playback sequence. On the record carrier,however, the portions are stored in a second, e.g. scrambled, order thatis different from the first order. The physical position on the recordcarrier where a respective portion is stored may then depend on thesecond order. Moreover, the first order may not be stored on the opticalrecord carrier. The first order, however, might be determined based onthe bytes read from the certain positions (see also FIG. 19F for furtherdetails in this respect).

As mentioned above, the byte values read at the certain positions mightbe used in various ways.

FIG. 19D shows an example where byte values are read at positions 274-1,. . . , 274-4. As seen, it is also possible that some byte values areread from unencrypted data. In the example of FIG. 19D, a byte value isread at position 274-3 from unencrypted data.

In the example of FIG. 19D, all byte values are read from a single BDAVtransport stream (*.m2ts) 275-1. This, however, is not necessary and itis possible that the bytes are read at positions in different transportstreams (*.m2ts).

In the example of FIG. 19D, the byte values read at positions 274-1, . .. , 274-4, correspond to the byte values 0x53, 0x1F, 0x0B, and 0x11,respectively. These byte values might then be used as key material, i.e.as input data, in a BD-J object 276. As thoroughly explained above andbelow the key material might influence the selection of a playlist,setting of an angle for playback, controlling a menu of the title storedon the Blu-ray disc and so on. As already mentioned in connection withFIG. 19A, the accessing speed for accessing the bytes at the variouspositions might be increased by reading larger data blocks into thememory of the playback device. For example, BD-J object 276 mightcomprise an instruction to read 1 megabyte of data which might includethe two aligned units 277-1 and 277-2.

As has been shown, in the embodiment of FIG. 19D, encryptionparameters/characteristics are extracted from the encrypted AV files.These encryption parameters (key material) may then be used for theoriginal disc check. The key material might be used in algorithms todiscriminate the correct playlist from fake playlists. Whenmanufacturing an original disc, this means that in the embodiment ofFIG. 19D, the BD-J object needs to be finalized or created after thedisc has been AACS encrypted (cf. FIG. 20).

An advantage of the embodiment of FIG. 19D is the following: The BD-Jobject e.g. pseudo randomly reads data from the transport streams. Thisdata will be different depending on whether the transport streamscontain encrypted or decrypted data. If a copy program has decryptedsome of the data, thus the data read will be different than from anoriginal. Thus, the read data can e.g. be used to discriminate correctand fake playlists: if the data is the same as that read from anoriginal disc, the correct playlist can be discriminated: else this isnot possible and the read data will lead to a wrong discrimination.

FIG. 19E shows yet another possibility for using the byte values read atthe certain positions. As an example, it is assumed that the same bytevalues 274-1, . . . , 274-4 are read from the same transport stream275-1 shown in FIG. 19D. Of course, this is just an example and the bytevalues could be read from other positions and from another transportstreams.

What is different in FIG. 19E with respect to the embodiment of FIG. 19Dis, however, the interpretation of the read byte values. In theembodiment shown in FIG. 19E, the read byte values corresponding to adata entity are interpreted as a Java class file.

With regard to the interpretation of the files as Java class files278-1, two possible embodiments exist:

First, it is possible that the read bytes, i.e. the data entity, isinterpreted as Java class file which is loaded into the program memory(also referred to as Heap or Stack) of a playback device which thendirectly execute the Java Class File. In other words, the byte valuesmay be read into a predetermined number of registers in thepredetermined area of the program memory and these predeterminedregisters are then interpreted as a Java class file which is loaded bythe BD-J object 278-2 during execution of the BD-J object 278-2. In thiscase no further processing of the read bytes is necessary.

A second possibility is that the read byte values, i.e. the data entity,is interpreted as a (new) Java class file which will be included in thelogical file system of the Blu-ray disc. This might be done by an updatecommand of the Blu-ray specification. For example, an update VFS(virtual file system) command might be executed. By such an updatecommand, it is possible that a file already existing in the logical filesystem will be replaced or updated. It is, however, also possible toinclude an additional file in the logical file system. Thus, the (new)file, i.e. the data in entity which is interpreted as a new file mighteither replace/update an existing file of the logical file system or itmight be added as a new file to the logical file system of the Blu-raydisc.

Again, various possibilities for influencing the behavior of the BD-Jobject 278-1 are feasible. For example, on the Blu-ray disc, a Javaclass file might already be stored and included in the logical filesystem which, however, might contain instructions that will lead to anundesired behavior during playback. For example, the Java class filestored on the optical record carrier might lead to a malfunction of themenu, selection of a false playlist and so on. During execution of theprogram instructions stored on the disc, a new Java class file might bedetermined dynamically. This new Java class file could then be includedinto the logical file system by replacing the Java class file stored onthe disc. This new Java class file might then lead to a correctfunctioning of a menu, selection of correct playlist and so on.

FIG. 19F shows yet another embodiment for another interpretation of theread byte values.

In this embodiment, the byte values (data entity) are interpreted as aplaylist file 279-1. For this, in the embodiment of FIG. 19F, theplaylist file 279-1 will be determined dynamically during execution ofthe BD-J object 279-2 which is stored on the Blu-ray list. In order toinclude the playlist file 279-1 into the logical file system of theBlu-ray disc, the same steps as outlined in connection with FIG. 19Emight be performed. The byte values might be read into the local memoryand an update VFS command might be executed. This could result in areplacement of a playlist file included in the logical file systembefore the updated command or in an addition of the playlist file to thelogical file system. The playlist file included in the file systembefore the update commend could be stored on the disc and could e.g.comprise a false (fake) playlist. The playlist file that is dynamicallygenerated could comprise a correct playlist (first order).

Further possibilities exist: for example, a Blu-ray disc might not atall include a playlist file. Thus, playback might not be possible atall. Then, when the Blu-ray disc is inserted into a Blu-ray player, theBlu-ray player might determine the playlist file by reading bytes at thecertain positions and generating a playlist file via an update VFScommand in the logical file system. Alternatively, as already mentioned,a playlist file could already be stored on the Blu-ray disc. However,this playlist file might lead to playback of advertisement or otherdisturbing content that is stored on the Blu-ray disc. Then, a newplaylist file will be generated dynamically as explained, and a newplaylist file might be replacing the already existing file.

FIG. 19G shows steps that might be executed on a playback deviceaccording to the embodiment shown in FIG. 19F. At S280-1, byte valuesare read at certain positions. As already briefly mentioned inconnection with FIG. 19A, it is possible that the certain positionscorrespond to predetermined positions, i.e. positions that are notmodified during execution of the BD-J object 279-2. However, it is alsopossible that the certain positions be determined dynamically. Forexample the positions might also depend on byte values stored at otherpositions.

At S280-2, a playlist will be created in the local memory. Then, atS280-3, a VFS update command might be executed. This will lead toincluding the playlist file which has previously been stored in thelocal memory (S280-2) in the logical file system of the Blu-ray disc. Asmentioned, either a file already existing in the logical file systemcould be replaced or modified or a new file could be added. Then, atS280-4, a playlist command might be executed. This will lead to usingthe playlist determined at S280-2 and S280-3 for playback.

FIG. 19H shows yet another embodiment where at S281-1 bytes are read atcertain positions. At S281-2, the read bytes are interpreted. Morespecifically, at S281-2, it is verified if the read byte values (dataentity) is a valid playlist. In case the optical record carrier is not aBlu-ray disc, but an optical record carrier of another format, it mightbe checked whether the read bytes correspond to a valid playback order.

If the optical record carrier is a Blu-ray disc, and the read bytes areinterpreted as a playlist according to the Blu-ray standard, at S281-2,it might be verified whether the read bytes correspond to a playlistaccording to the Blu-ray standard. This is determined based on certaincharacteristics of the playlist according to the Blu-ray standard. If itis not a valid playlist, processing proceeds to S281-3. Thus, in thiscase, a playlist, e.g. a fake or advertising playlist, i.e. anon-genuine playback order, might be used for playback which is storedon the disc. Thus, this playlist stored on the disc might comprise playitems that will lead to playback of advertisement or other distractingcontent which is stored on the disc. Of course, any other of the abovedescribed disturbing features might be realized, e.g. additionallyand/or alternatively, the menu might be modified and so on.

However, if at S281-2 it is determined that the read bytes correspond toa valid playlist, processing proceeds to S281-4. Thus, a playlist filemight be created in the local memory. At S281-5, a VFS update command isexecuted. This may lead to a replacement of the playlist filecorresponding to the playlist stored on the disc. In other words, theplaylist file which is stored on the disc and which might have beeninitially loaded can be replaced by the playlist file stored in thelocal memory by executing the VFS update command. At S281-6, theplaylist which has been included as a playlist file at S281-5 into thelogical file system by executing a VFS update command will be used forplayback.

In a further embodiment shown in FIG. 19I, another possibility ofinterpreting the bytes read at the certain positions is shown. In thisembodiment, the read byte values correspond to at least a part of theUnit_Key_RO.inf file of the AACS encryption standard.

FIG. 19I shows on the left hand side a Blu-ray disc 281-1 schematicallyshowing the logical file system. A part of the file system correspondsto AACS specific files in the AACS directory. One of the files of theAACS is the Unit_Key_RO.inf file. As known by a person skilled in theart and as e.g. defined in the AACS standard, the Unit_Key_RO.inf filemay comprise one or more title keys for CPS units, the title keys beingencrypted. During playback of the AACS encrypted content stored on theBlu-ray disc 281-1, the title keys stored in the Unit_Key_RO.inf filewill be decrypted using the Media Key and the Volume ID (see AACSstandard for details in this respect).

However, as is evident, in order to decrypt the title key for playbackof AACS encrypted content, a Unit_Key_RO.inf file is necessary thatcomprises the encrypted keys and not other data or corrupted key data.At least some encrypted title keys must be stored in the Unit_Key_RO.inffile. Otherwise playback of encrypted content will not be possible.

In the embodiment of FIG. 19I, at least some of the title keys stored inthe Unit_Key_RO.inf file might include corrupted data, i.e. a part ofthe file does not contain an encrypted title key but some other data,e.g. corrupted data or the like. From the corrupted data the (correct)decrypted title key cannot be determined. Thus, playback will not bepossible at least for a title for which no encrypted title key isavailable.

According to the embodiment shown in FIG. 19I, the Unit_Key_RO.inf filewill be modified, replaced or added to the AACS directory dynamically,e.g. during playback/accessing of the Blu-ray disc 281-1 in a Blu-rayplayer. The Unit_Key_RO.inf file will be replaced, modified or added tothe logical file system by a VFS update command. In other words, thebytes read at the certain positions are in the embodiment of FIG. 19Iinterpreted as the Unit_Key_RO.inf file and the Unit_Key_RO.inf filecreated in the local memory will be included in the logical file systemof the Blu-ray disc at runtime (dynamically) in the Blu-ray player.

In a further embodiment the Unit_Key_RO.inf file 281-2 may comprise onevalidly first encrypted title key and other corrupted data e.g. havingthe appearance of a second encrypted title key. The first title keymight allow playback of at least a part of the content stored on theBlu-ray disc 281-1. For example, the first encrypted title key stored inthe Unit_Key_RO.inf file on the Blu-ray disc 281-1 may allow playback ofan intro of a movie and/or a copyright protection trailer. Then, whilethis content is reproduced (or at another suitable moment and time), theprogram instructions on the Blu-ray disc might cause the Blu-ray playerto read bytes at certain positions which are then included in the localmemory and interpreted as (new) Unit_Key_RO.inf file. This newUnit_Key_RO.inf file might then be included in the logical file systemon the side of the player by a VFS update command. After the VFS updatecommand, the new Unit_Key_RO.inf file will be used for furtherdecrypting the further content stored on the disc, e.g. a main movie.This way, even from an illegal copy, playback of at least a part of thecontent may be possible while other portions may not be decryptable. Inother words, it is possible to design a disc such that some portions ofthe content may be reproducible even without reading correct, i.e.expected, bytes at certain positions since a valid encrypted key forthis content is already stored in the Unit_Key_RO.inf file on the disc.However, other portions of the content may not be decryptable withoutreading the correct, i.e. expected, byte values at the certain positionsand including the (correct) dynamically generated Unit_Key_RO.inf filewhich will then be used for content decryption.

This is illustrated in FIG. 19I by using reference signs 281-2, and281-3. The Unit_Key_RO.inf file 281-2 stored on the disc might compriseone valid encrypted title key which allows decryption of a first portionof the content, e.g. a trailer. This Unit_Key_RO.inf file could e.g. beused in the beginning of playback of the content stored on the disc.Afterwards (it is also possible that it is before or at other suitablemoments) a new unit key Unit_Key_RO.inf file will be created in thelocal memory and included in the logical file system by a VFS updatecommand. In the example shown in FIG. 19I, this is the Unit_Key_RO.inffile 281-3. This Unit_Key_RO.inf file will be used for playing back theremaining encrypted content stored on the disc.

The embodiment of FIG. 19I is further illustrated in FIG. 19J. FIG. 19Jshows a replicator 282-1, the Blu-ray disc 281-1 already shown in FIG.19I and a playback device 282-2. On the replicator side 282-1 (e.g. at amanufacturing site of the Blu-ray disc 281-1) two title keys X, Y mightbe encrypted. However, only the encrypted title key X is stored in theUnit_Key_RO.inf file 281-2 on record carrier 281-1. The encrypted titlekey Y is used for generating program instructions 282-3, correspondinge.g. to the first portion of program instructions shown in FIG. 19A. Theprogram instructions could e.g. be determined based on a result of aparser that may scan the encrypted content for appropriate positions ofthe bytes representing the encrypted title key Y. In other words, theprogram instructions 282-3 will be designed such that bytes at certainpositions will be accessed which bytes correspond, when assembled, tothe encrypted title key Y. As seen, the Unit_Key_RO.inf file 281-2stored on Blu-ray disc 281-1, however, only comprises title key X (inencrypted form). The Unit_Key_RO.inf file 281-2 does, however, notinclude the encrypted title key Y but instead some corrupted data whichis referred to as “corrupted title key”.

On the playback device, if the Unit_Key_RO.inf file 281-2 is used forplayback, only the title which can be decrypted with title key X can beplayed back unless title key Y in encrypted manner can be reconstructedby executing the program instructions 282-3. As said, this will actuallybe done by dynamically creating a new Unit_Key_RO.inf and including itinto the logical file system of the disc.

If the Blu-ray disc 281-1 is a pre-recorded disc or a legal copy, thenthe content will be stored on the disc in an encrypted manner (AACSencrypted). Therefore, when playing back Blu-ray disc 281-1, at S282-4,byte values will be read at the certain positions (determined e.g. bythe parser at the time of manufacturing the disc) and the read bytevalues will have the expected values that allow creating the validUnit_Key_RO.inf file containing the encrypted title keys X and Y. Thisway both titles (content portions) assigned to title keys X and Y may bedecrypted. If, however, a disc is an illegal copy, then the contentmight no longer be AACS encrypted. This way different bytes will be readat the certain positions than in case of reading the bytes from apre-recorded disc or legal copy. Thus, a corrupted Unit_Key_RO.inf filemay be generated with does not allow decryption of at least a part ofthe content stored on the disc.

The bytes read at S282-4 are thus interpreted as Unit_Key_RO.inf fileand this newly created Unit_Key_RO.inf file will be included in thelogical file system of the Blu-ray disc via a VFS update command atS282-5. Therefore, at S282-6, the newly created Unit_Key_RO.inf filemight be used for decrypting title key X and title key Y which can thenbe used at S282-7 to decrypt the encrypted content stored on the disc282-1 (of course, this does not work for an illegal copy for the reasonsset out above).

When the disc is inserted in a player, the program instructions 282-3(e.g. BD-J object). e.g. the second portion as shown in connection withFIG. 19A, might initiate playback of first content, e.g. a trailer orcopyright notification, stored on the disc and being associated withtitle key X (this content is e.g. part of a first CPS unit). Sinceencrypted title key X can be found on the disc directly (since it is notcorrupted data), at least this portion of the content stored on the discmight be reproducible by the playback device even without reading thebytes at the certain position or when reading “false” byte values froman illegal copy. In other words, even from an illegal copy this portionof the content associated with title key X may be reproduced correctly.However, since the encrypted title key Y is not stored on the discdirectly (but will be generated dynamically at S282-4 and S282-5), itwill not be possible to playback second content associated with titlekey Y (this content is e.g. part of a second CPS unit) unless thecorrect byte values are read from the certain positions.

As has been seen above, FIGS. 19I and 19J show a method of using dataextracted from an AACS encrypted content (reading bytes at certainpositions in areas where the encrypted content is expected), where e.g.a collection of bytes (data entity) of the transport stream files (e.g.the files 00000.m2ts and/or 00001.m2ts shown in FIG. 19I) of theencrypted master disc define the Unit_Key_RO.inf file. During playbackof the BDROM title, a BD-J object (program instructions, e.g. programinstructions 282-3 shown in FIG. 19J or program instructions 272-4 ofFIG. 19A) extracts this data from the AACS encrypted content and storesthe bytes as the Unit_Key_RO.inf file in the BUDA (Binding Unit DataArea) of the local storage of the playback device (which requires atleast a BD profile 1.1). After the execution of a VFS (Virtual FileSystem) update, this file replaces the original file on the pre-recordeddisc.

The BD-ROM standard specifies CPS units where for each of these units, aunique title key for encryption of the AV content might be stored inencrypted manner in the Unit_Key_RO.inf file. As explained above, thisallows hiding the CPS unit key (by removing the encrypted title key fromUnit_Key_RO.inf file on a pre-recorded disc or by storing a corruptedversion) for the main movie (this could be e.g. 00001.m2ts shown in FIG.19I) within the AACS encrypted AV data and create it dynamically duringplayback in the BUDA of the local storage. The transport stream00000.m2ts in FIG. 19I could e.g. contain a HDMV intro (includingcopyright warnings/notifications or the like) and a HDMV menu and couldbe decrypted because the encrypted title key for this CPS unit isavailable on the disc (this could correspond to encrypted title key Xshown in FIG. 19J). On selection to start the main movie, the BD-Jobject (program instructions 282-3) will do its job and extract thebytes for the title key (e.g. title key Y) for the main movie CPS unitby accessing bytes at certain positions in the encrypted content.

Thus, also if the AACS is broken (compromised) a copier may not decryptthe AACS encrypted files depending on the hidden CPS unit key becausethe copier (copy tool) is missing the encrypted title key. Illegal copytools currently do not need to launch/analyze the BD title to circumventthe standard protection—this is a convenience feature of such copy toolsproviding a stand-alone solution (one click) for copying a disc. Whenimplementing the method as described, it would be more difficult for acopy tool to make a copy since the BD title would have to be thoroughlyanalyzed. Moreover, in order to hack the copy protection it would benecessary to have the complete AV data at hand (in order to analyze thepositions where bytes are read). This means that a hacker will need tohave a large amount of data (e.g. 20 gigabyte) which might not easily betransmitted e.g. over the Internet.

As described, in the embodiments of FIGS. 19A to 19J, byte values areread at certain positions. In a further embodiment (not shown), datarepresenting the certain positions may be provided on a server fordownload. In order to provide a copy protection, the server onlysupplies the “correct” positions in case the optical data carrier hasbeen identified to be an original (this identification is done asdescribed throughout this specification). “Correct” positions means thatpositions are provided which allow the assembly of a data entity suchthat a content reproduction is possible in genuine quality. In thisregard, all of the possibilities described in connection with FIGS. 19Ato 19J are possible. For example, the data entity may represent keymaterial as shown in FIG. 19D, a Java Class File as shown in FIG. 19Eand so on. For example, in case the “correct” positions are supplied,this may lead to selection of the correct playlist among a large numberof fake playlists and so on.

However, in this embodiment, in case the disc check fails and it isdetermined that the record carrier is not an original, either no certainpositions are supplied from the server or certain positions which allowreproduction only in non-genuine quality. For example, key material asin FIG. 19D may be determined which will lead to selection of a fake,e.g. advertisement, playlist and so on. All of the possibilitiesdescribed throughout this specification for reproduction in non-genuinequality are applicable.

FIG. 20 shows steps that may e.g. be part of a mastering process for aBlu-ray disc. At S283-1 encrypted content is determined. This encryptedcontent is e.g. encrypted audio visual or audio content to be stored inthe first area 272-6 shown in FIG. 19A.

At S283-2, program instructions are determined. At S283-3, offsets(positions) of bytes may be determined, e.g. searched (parsed) in theencrypted content. For example, at S283-3, bytes representing keymaterial (cf. FIG. 19D), a Java class file (cf. FIG. 19E), a playlistfile (cf. FIG. 19F), and/or a Unit_Key_RO.inf file (cf. FIGS. 19I and19J) might be searched in the encrypted content. Since the encryptedcontent is a large amount of data, every possible byte value out of the255 possible byte values will statistically occur at some positions.These positions are then used to determine program instructions. (e.g. aBD-J object) that will, when executed on a playback device, read thebyte values at the respective positions. The positions are e.g. includedin the BD-J object (program instructions), either compiled to or in aseparate file describing these positions.

Thus, at S283-4, the program instructions that have initially beendetermined at S283-2 might be modified so as to incorporate reading thebytes at the certain positions. Also, commands such as e.g. VFS updatecommands or further instructions for modifying the control flow or thelike might be included at this stage.

Then, at S283-5, the data to be written on the record carrier isfinalized. This data includes the encrypted content data which has beendetermined at S283-1 (and which has not further been modified) and themodified program instructions determined at 283-4.

As has been seen above, in FIGS. 19D, 19E, and 19F, the data entity(representing key material, a Java class file, and a playlist file,respectively) is not assembled for the purpose of content decryption.The data entity is also not assembled as data to be decrypted. Thelatter is also the case for FIGS. 19I and 19J where the data entityrepresent the Unit_Key_RO.inf file of the AACS encryption standard.

As has also been seen above, the copy protection is effective since ifthe AACS encryption is removed this would result in “wrong” byte valuesbeing read from the certain positions. This would then result in variousdisturbances when trying to playback disc (including e.g. amalfunctioning menu, usage of a fake playlist, etc.). Thus, if a copierremoves the AACS copy protection, the (illegal) copy will not behavelike the original during playback.

Regarding FIGS. 19A to 19J, it should also be noted that the certainpositions could be (pseudo) random positions distributed across all ofthe encrypted content. This way, a copier cannot do an analysis of theBD-J object without the complete AV content (which is huge in sizecompared to the size of the BD-J object).

As should also be clear, FIGS. 19A to 19J could be used for the decisionwhether a disc is an original or copy, e.g. by verifying just one bit orbyte value at a predetermined or dynamically determined position in theencrypted content. In fact any predetermined number of bits and/or bytescould be used. Thus, any bit and/or byte sequence could be read as a keyfor verifying whether the disc is an original or a managed copy andstill comprises content stored in encrypted manner (as is clear, in caseof decrypted content, the read bytes would in general be different atthe positions).

In further embodiments, there may also be provided a method for copyprotection that will be explained at hand of FIGS. 21 to 24. Of course,these embodiments may be combined with any of the previously explainedembodiments.

As seen in FIG. 21, there may be provided a sequence of genuine videoframes 290 including genuine video content 292 that is to be stored on arecord carrier 294 in a copy protected manner. E.g. for copy protection,the genuine frames 290 might be divided into a first portion 296 and asecond portion 298. As seen, the second portion 298 is smaller than thefirst portion 296. The ratio of the size of the second portion 298 tothe first portion 296 may e.g. be 1:6 to 1:3.

Also, as can be seen, the first portion 296 corresponds to the genuineframe 290 excluding the second portion 298 (the content of the secondportion); and the second portion 298 corresponds to the genuine frame290 excluding the first portion 296.

Based on the first portion 296, a first video sequence 300 may bedetermined e.g. the first portion 296 (without the video content inregion 298) is encoded to obtain respectively encoded video data. Thefirst video sequence 300 corresponds to the genuine frames 290 excludingthe second portion 298 (the content). Also, there may be determined asecond video sequence 302 that corresponds to the genuine frame 290excluding the first portion 296.

Thus, when reproducing the first video sequence 300, only the content ofthe genuine frame excluding the content of the second portion 298 isreproduced. Also, when the second video sequence 302 is reproduced, onlythe content shown in the “window” corresponding to the second portion298 is reproduced.

The first and second video sequences 300, 302 may be stored on therecord carrier 294 as first file 304 and second file 306, respectively.

An advantage of dividing the genuine frames 290 into first and secondvideo sequences 300, 302 which may be stored as separate files 304, 306on record carrier 294 is that a copy program might only copy one of thesequences. i.e. either the first video sequence 300 or the second videosequence 302. Since the file size of the first file 304 will be muchlarger than the file size of the second file 306 which is due to thefact of the different sizes of the first and second portions 296, 298,copy programs might only copy the large file, i.e. the first file 304.This is because a copy program might suspect a large file to include amain movie whereas small files may be considered as bonus tracks or thelike. In case of a Blu-ray disc, this effect may be enhanced if aplaylist (fake playlist, non-genuine playlist) is included on the discthat does not reference the second video sequence 302 at all.

If the record carrier is a Blu-ray disc, then the first video sequence300 may correspond to or be stored in a portion of a clip 304-1. Thesecond video sequence 306 may correspond to a further clip or be storedin a portion of a further clip 306-1 as shown in FIG. 22. The respectiveportion of the first clip 304-1 could be referenced by a PlayItem in aplaylist as a main path, whereas the respective portion of the secondclip 306-1 could be referenced in a playlist as a subpath (as sub playitem, here written as “SubPlayItem”).

In order to reproduce the genuine video content without any artifacts,the first and second video sequences 300, 302 (which in case of aBlu-ray disc could be included in first and second clips 304-1, 306-1)must be reproduced synchronously. This may be done by designingrespective playlists.

Thus, there may be one playlist stored on the Blu-ray disc oralternatively downloaded from a server (as explained above at hand ofFIG. 9) that allows a synchronous playback of the two video sequencesstored in the first and second clips 304-1, 306-1.

In order to improve the copy protection, there may also be stored aplurality of further playlists (additional fake playlists) on the disc.If one of these further playlists is used for playback, the first andsecond video sequences might not be reproduced synchronously. Further,on the disc there may be stored some program instructions, e.g. in aBD-J object, that when executed discriminate the playlist that allowssynchronous playback from the further playlists based on characteristicparameters or encryption parameters of the record carrier (as explainedabove).

In fact, all of the above explained methods for original disc check/keyextraction may be used for discriminating the playlist allowingsynchronous playback from other playlists.

In a further embodiment shown in FIG. 23A fake playlists (throughoutthis specification also referred to as “non genuine playlists”) may bedetermined based on combining PlayItems (PI's) with SubPlayItems(SPI's), where the SubPlayItems reference video sequences that do notmatch to a respective PlayItem.

In FIG. 23A, three clips clip#1, clip#2 and clip#3 are shown comprisingdifferent video portions 2400 to 2404. In the example of FIG. 23A, onlythe second playlist playlist#2 is an original playlist allowing playbackin genuine quality. Thus, only playlist#2 may result in a reproductionof the genuine video content stored on the disc, i.e. reproduction ofthe genuine frames.

In the embodiment shown in FIG. 23A, video portions 2400, 2401, 2402,and 2403 are portions of the genuine content stored on the opticalrecord carrier, i.e. portions 2400, 2401, 2402, and 2403 belong togenuine frames. Video portion 2404 of clip#3, however, comprisesadvertisement. This portion is referenced in playlist#3 bySubPlayItem#1-31 as indicated in FIG. 23A by the dashed lines. The otherreferences can easily be seen from FIG. 23A, e.g. SubPlayItem#1-12 ofPlaylist#1 references portion 2403, PlayItem#1-31 of Playlist#3references portion 2400 and so on.

In the example of FIG. 23A, portions 2400 and 2401 store respectivefirst video sequences. In the example, the first video sequence storedin portion 2400 corresponds to first video sequence 300 of FIG. 21.Moreover, portions 2402 and 2403 store respective second video sequencesin the sense as explained above in connection with FIG. 21. In theexample, the second video sequence stored in portion 2403 corresponds tosecond video sequence 302 of FIG. 21.

The different results of reproduction when using the playlists#1, #2,and #3 of FIG. 23A for playback are shown in FIG. 23B.

As seen, when playlist#1 is used for reproduction, first the content ofvideo portion 2400 which is referenced by PlayItem PI#1-11 is reproducedtogether with the video content stored in portion 2402 referenced bySubPlayItem SPI#1-11. However, since this content does not correspond tothe “missing” portion belonging to the content of portion 2400, thecontent of portion 2402 will be seen as a picture in the picture of thecontent of portion 2400. This will be distracting to a viewer.

As seen in FIG. 23B, only when using playlist#2 (original playlist), thegenuine frames will be reproduced. Since the second video sequence 2403corresponds to the first video sequence 2400, the two video sequences(portions of the genuine frames) will be Joined together as in a“puzzle”. Thus, a viewer will not note that the second video sequence2403 is actually “inserted” into the first video sequence 2400. The samehappens in the right picture when using the playlist#2 for playback(this is the second picture from the top in the right column of thepictures shown in FIG. 23B). Here, the second video sequence 2402 isinserted in the first video sequence 2401. Again, the viewer will notnote this since the two video sequences belong to the same genuineframes.

As seen in the example of FIGS. 23A and 23B, when playlist#3 is used,and when the portion 2400 is reproduced, at the same time portion 2404will be reproduced comprising advertisement. Thus, the viewer will bedistracted by the advertisement.

As should be clear from FIGS. 23A and 23B, it is not necessary toprovide additional content such as the advertisement content stored inportion 2404, on the disc, in order to create additional (fake)playlists. Such additional (fake) playlists can also simply bedetermined by referencing via a SubPlayItem a “wrong” missing portionswhen reproducing a certain first video sequence, see e.g. the resultshown in the upper left corner of FIG. 23B where a wrong missing videosequence (stored in portion 2402) is inserted into the video sequencestored in portion 2400. In this case the video sequence stored inportion 2402 may be referred to as third video sequence, whereas portion2400 stores a first video sequence and portion 2403 (which is the“missing” portion) stores a respective second video sequence.

In a further embodiment, it may also be possible to not provide theoriginal playlist (genuine playlist) at all on the disc. Thus, onlyplaylists referencing wrong missing portions might be included on thedisc. The original playlist might be determined by reading bytes atcertain position from the AACS encrypted content (see e.g. FIG. 19F andcorresponding description) or it may be provided on a server fordownload.

If the correct playlist is stored on the disc among a plurality of fakeplaylists, the correct playlist (in the example of FIGS. 23A and 23Bthis is playlist#2), may be discriminated (distinguished) from the fakeplaylists based on the same techniques explained, i.e. “key extraction”and selection of playlist based on program instructions using the keydata as input data. Of course, the embodiment of FIGS. 23A and 23B (aswell as the embodiment of FIG. 23C described in the following) may becombined with the clip slicing and shuffling. In this case thepossibilities of generating additional (fake) playlists describedthroughout the specification may be combined and the effect of confusingcopiers can be increased.

In yet another embodiment shown in FIG. 23C (that may be referred to as“fake playlists based on playlists with a plurality of sub-pathsand—optionally—with dynamically changing subpath during playback”), aplaylist with a plurality of different sub-paths may be provided. Onlyone of the sub-paths may be the correct sub-path that will lead to acorrect insertion of the missing portion into a main path. The correctsub-path may again be determined during playback based on the extracted“key material”. Also, the correct sub-path that will lead to theinsertion of the correct second video sequence into a first videosequence, may be changed dynamically as seen in FIG. 23C. As seen, forthe first two PlayItems #1 and #2, the SubPlayItem #3 is the original(“correct”) SubPlayItem that will lead to a reproduction in genuinequality. However, for PlayItem #4, there are less SubPlayItem and,moreover, it is now the SubPlayItem #1 that references the original(missing) portion (second video sequence).

The abbreviation “SPI” in FIG. 23C means SubPlayItem. As should beclear, in FIG. 23C, if the wrong SubPlayItem, e.g. the SubPlayItem #1for PlayItem #1 is selected for playback, this will lead to apicture-in-picture effect that will distract the viewer. If, however,the SubPlayItem #3 (original SPI) is used for PlayItem#1, then the viewwill not notice that actually a SubPlayItem is at all displayed. This isthe same for FIG. 23A. As is readily apparent, the section of theoriginal (“correct”) SubPlayItem could be made dependent on the keymaterial (e.g. encryption characteristics) and the program instructionsthat will be used for reproducing the content.

The two embodiments of FIG. 23A “fake playlists based on playlists withdifferent sub-paths” and FIG. 23C “fake playlists based on playlistswith a plurality of sub-paths” may be combined.

FIG. 24A shows an embodiment where a Blu-ray disc 308 comprises a BD-Jobject 309 for controlling playback and for performing an original disccheck/key extraction. The disc 308 further comprises a plurality ofaudio video files 310, 312, 314. The file 314 might correspond to afirst video sequence as e.g. the first video sequence 300 shown in FIG.21. In other words, the file 314 may be a large file excluding a smallerportion such as e.g. the second portion 298 of FIG. 21.

The files 310, 312 may be smaller in size. The size may e.g. be the samesize as that of the second portion 298 of FIG. 21. However, only file310 may comprise the “missing portion”, i.e. the portion of the genuineframe that is missing in the file 314. File 312 may comprise othercontent than file 310. When the disc 308 is a copy and it is played backon a player 317, the player 317 in a Java virtual machine 316 mayperform an original disc check. In the example of FIG. 24A, the disc 308is a copy so that the original disc check fails. Thus, a playlist storedon the disc 308 might be selected that references file 314 as a mainpath and file 312 comprising junk data as a subpath. The two files 314and 312 will be played back together such that the result is as shown onthe right hand side of FIG. 24A. The picture denoted with reference sign318 may result from file 312 and the picture with reference sign 320 maybe the result of file 314.

The content of the file 312 might e.g. include advertisement or otherjunk content. Moreover, the content might be “eye-catching” videocontent that will distract a viewer from the content of the main movie.In the example of FIG. 24A, the content shown at 318 is e.g. a shootingscene that will distract the viewer from the quiet scene depicted at320.

FIG. 24B shows a further embodiment where a disc 322 only has one filestored thereon. For illustrative purposes, this file might be the samefile 314 as shown in FIG. 24A, i.e. it might be a file comprising alarge portion of genuine frames such as the first video sequence 300shown in FIG. 21. However, disc 322 does not contain a file that wouldcorrespond to smaller portions such as e.g. a second portion 298 shownin FIG. 21. Thus, if a player was to play only the file 314 there wouldbe a blank space as shown in the frames 300 in FIG. 21 (or there wouldbe advertising or distracting content shown in case theadvertising/distracting content has been included in the video sequenceof the main path).

The missing portion, e.g. the second portion 298/second video sequence302 shown in FIG. 21 might be provided on a server 321 for download.Access might only be allowed if disc 322 has been determined to be anoriginal or a legal (managed) copy. Otherwise, the server 321 mayprovide junk or advertisement content. The content provided by theserver 321 in FIG. 24B may, therefore, provide video data to be used ina subpath, whereas the video to be produced as a main path in a playlistmight be provided from the disc 322.

In the example of FIG. 24B, the disc 322 is a copy so that an originaldisc check of the BD-J object/Java virtual machine fails and, therefore,the server 321 provides advertisement content. This is depicted at theright hand side where at 323 a commercial for a car of “BRAND X” isincluded in the main movie depicted at 320.

Of course, as already mentioned, if the disc check succeeds, i.e. thedisc is an original, then the second portion from the genuine frameswould be synchronously reproduced with the first portion of the genuineframes. Thus, a viewer would not notice that a portion of the viewedpicture results from a main path and another portion from a subpath.

Of course, it is also possible that in a further embodiment (not shown)only a portion of a second video sequence, e.g. a portion of the secondvideo sequence 302 shown in FIG. 21 would be stored on the recordcarrier and a remaining portion of the second video sequence would bedownloaded from a server if the original disc check succeeds.

As shown in FIGS. 24A and 24B, there is provided an effective method forcopy protection since if the original disc check fails,distracting/eye-catching content might be included in a main movie.Moreover, in FIG. 24B, the copy protection can be realized withrequiring only little bandwidth since the portion that will be includedif the original disc check succeeds is very small in size and can beeasily downloaded from a server.

As regards the embodiments of FIGS. 21 to 24, it should be noted that itis possible that the picture-in-picture only be applied to some portionsin e.g. a movie as original AV data (content) that shall be copyprotected. In other words, only for some portions of the AV data twoseparate video sequences are determined whereas for other portions therewould be only one video sequence. In this case, only some PlayItems of aplaylist may have a sub-path referencing the missing portions encoded inthe one video sequence that will be displayed as a picture in picture.This may be difficult for copiers to spot. I.e. a copier might at firstsight not notice that in some portions, the PiP function of the BDstandard is used for including distracting content in case the originaldisc/managed copy is not used for playback.

Also, in a further embodiment, the video sequence of the main path mayalready include advertising or distracting content in the region of thesmaller portion. For example, in FIG. 21, the region in first videosequence 300 where the second portion 298 has been “cut out” might befilled with a video sequence corresponding to advertising or otherdistracting content. This resulting video sequence could then beencoded, such that it would be played back when being referenced by amain path in a playlist. If the original disc check succeeds, then aplaylist could be selected where a video sequence referenced in thesub-path overlays the advertising/distracting content.

In yet a further embodiment, the cut out portion (second portion 298 inFIG. 21) could be moving, i.e. appear at different positions, during thecourse of a movie (or other video content). For example, the smallerpicture could be moving over faces of persons in a movie. Thus, theposition of the second portion 298 in FIG. 21 (and portions 318, 320 inFIGS. 24A and 24B) may depend on the video content that is to be copyprotected. The position may be chosen such that it distracts a viewermost from the content if the cut out portion is not inserted but othercontent. For example, if advertising content is included, theadvertisement would be displayed over faces of persons in movies. Thiswould certainly distract a viewer. The distraction may be increased byswitching on/off the PiP and moving it additionally. In this case, if a“wrong” playlist is used, not only would advertisements be moving butalso the advertisements would be switched on and off. This is also veryannoying for viewers.

In a further embodiment of a method for copy protection shown in FIG.25, it may also be possible that in a logical file system of an opticalrecord carrier a plurality of file names, i.e. logical file names of thelogical file system reference the same physical part of a disc. Again,this concept can easily be combined with any of the above describedembodiments.

In FIG. 25, a record carrier, e.g. an optical record carrier, has fourdifferent areas (portions) 330-1, . . . , 330-4 that each correspond tophysical areas (portions) of the disc, e.g. different physical blocks orsectors.

Each or at least a part of the areas 330-1, . . . , 330-4 may beaccessed via different logical file names in the logical file system ofthe record carrier. For example the first area 330-1 may be accessed,i.e. referenced, in the logical file system by the logical file names:clip#1, clip#5, clip#9 and clip#13.

Thus, when a playback device receives an instruction to read clip#1 aslogical file name, area 330-1 will be accessed by e.g. an opticalpickup. Area 330-1 will also be read in case the playback devicereceives an instruction to access clip#5, clip#9 and/or clip#13.

If the record carrier is e.g. a Blu-ray disc, then the logical filesystem may e.g. be a UDF file system such as e.g. UDF2.50 file system.However, in order to use a plurality of logical names to reference asame area, the UDF file system of such a Blu-ray disc might have to bemodified. For example, file entries might be added, physical positionsof the data might be changed and/or the reference lengths may bechanged.

Independently of whether the record carrier is a Blu-ray disc, DVD orany other known or future format, the concept of using a plurality ofdifferent file names for accessing a same area allows creating aplurality of different orders, e.g. playlists, for playing back a samecontent by accessing the same physical areas.

For example, in FIG. 25 a playlist PL#1 will play, in the logical filesystem, clip#1, clip#6, clip#11 and clip#16, thereby accessing areas330-1, 330-2, 330-3 and 330-4, respectively. Playlist PL#2 will play, inthe logical file system clip#5, clip#10, clip#15 and clip#4, therebyaccessing the physical areas in the same order as for playlist PL#1,i.e. areas 330-1, 330-2, 330-3 and 330-4, respectively. Also playlistsPL#3 and PL#4 depicted in FIG. 25 will lead to the same order ofaccessing the physical areas 330-1, 330-2, 330-3 and 330-4.

Thus, all of the playlists PL#1 to PL#4 in fact playback the physicalareas 330-1, 330-2, 330-3 and 330-4 in the same order. However, in thelogical file system, different clips are accessed.

The accessing in the logical file system is shown in FIG. 26. Note thatthe example of FIG. 26 corresponds to the example in FIG. 25. However,FIG. 26 shows only the logical file system. For example PlayList#1corresponds to PL#1 in FIG. 25 and comprises the following PlayItems:PI#1, PI#2, PI#3, and PI#5 leading to playback (in the logical filesystem) of the files clip#1, clip#6, clip#11, and clip#16, respectively.

Thus, FIGS. 25 and 26 illustrate an embodiment where a plurality of AVfiles that may e.g. be stored in the areas 330-1 to 330-4, are stored onan optical record carrier. The AV files may have a first order. Forexample, if there is a one-to-one mapping between an AV file and anarea, the first order may be defined by the position of the area, i.e.the first order is: 330-1, 330-2, 330-3 and 330-4.

When the AV files are played back in the first order, audiovisualcontent of the AV files may be reproduced in a genuine playbacksequence. For example, if the AV files corresponding to the areas 330-1,. . . , 330-4 corresponds to a movie, then the movie will be played backas created by a director.

As also seen in FIGS. 25 and 26, the logical file system is designedsuch that a plurality of file names of the logical file system allowaccessing the same areas/AV files. For example, the AV filecorresponding to area 330-2 may be accessed by the different logicalfile names clip#2, clip#6, clip#10, and clip#14.

Moreover, as FIG. 25 shows, there may be a plurality of playlists, e.g.a first and a second playlist that each indicates a playback of theplurality of AV files/areas in the first order. The playlists differ inthat a different sequence of logical file names is used when playingback the areas. However, the physical access of an optical pickup isalways the same.

An advantage of using different logical names for accessing the samephysical area is that a copier might make a copy based on the logicalfile names. Consequently, the copier, e.g. a copy program, will copy thesame area many times. In the example of FIG. 25, each of areas 330-1 to330-4 might be copied four times since for each area four differentlogical names are used. This will lead to a huge amount of data. In theexample of FIG. 25 the data will be four times the amount of data thatis actually stored on the record carrier. For example, if a recordcarrier is a Blu-ray disc with 50 Gigabyte of storage, a copy of a copyprogram copying logical file names might be 200 Gigabytes.

Of course, FIG. 25 is only an example and in reality a much largernumber of logical file names might be used. In such a case, the amountof data will increase even more and the huge amount of data will bedifficult to handle for copiers. Moreover, it may be easy to make anoriginal disc check. If a copy program or copier makes a copy based onthe logical file names then the arrangement of the physical areas mightbe depending on the logical file names as depicted in FIG. 27.

FIG. 27 shows what will happen if a copier copies by the logical filenames and stores the areas associated with the copied logical file namesin the order of the logical file names. In the example of FIG. 27clip#1, clip#2, clip#3, clip#4, clip#5, and clip#6 might e.g. be storedin physical areas 330-5, 330-6, 330-7, 330-8, 330-9, and 330-10respectively. Thus, data is physically created for a copy of clip#6which is not the case in the original disc as shown in FIG. 25.

Moreover, when the playlist PL#1 is used for playback, the accesscharacteristic for clip#1 and clip#6 will be different. In the exampleof the original disc shown in FIG. 25, the areas 330-1 and 330-2 thatwill be accessed by clip#1 and clip#6 respectively are adjacent to eachother. However, on the copy areas 330-5 and 330-10 which will beaccessed by the logical file names clip#1 and clip#6 respectively, arephysically further apart. Therefore, an access time, e.g. of an opticalpickup or a reading head of a hard disc will be different.

This effect could be used for preventing playback of the AV files ingenuine quality. Alternatively, it could be used for stopping/preventingplayback altogether. Therefore, the optical record carrier may comprisepredetermined access characteristic data of an optical pickup whenreading the AV files from a pre-recorded optical recording carrier. Forexample in FIG. 25, the optical disc on which areas 330-1, 330-2, 330-3,and 330-4 are stored may comprise data that are descriptive of accesstimes of an optical pickup when first accessing clip#1 and then clip#6.

Further, the optical record carrier may comprise program instructionsthat when executed compare the access characteristic data of the opticalpickup when reading from a pre-recorded optical record carrier to accesscharacteristic data of a pickup (optical or magnetic pickup) of theplayback device when reading the AV files.

For example, when the AV files are read from a copy (this could be anoptical record carrier or a hard disc) actual access characteristic datamight be determined. In FIG. 27, such actual access characteristic datamay, for example, be descriptive of the access time when accessingclip#1 and then consecutively clip#6 which are stored in areas 330-5 and330-10, respectively.

Since the logical file names clip#1 and clip#6 lead to an access indifferent physical areas, the access times, i.e. the actual accesscharacteristic data, will be different than the access times whenaccessing areas 330-1 and 330-2 on the original optical record carrierof FIG. 25 by using logical file names clip#1 and clip#6.

Thus, there might be a deviation of the predetermined accesscharacteristic data that describe the access characteristic whenaccessing on the pre-recorded/original optical record carrier as shownin FIG. 25 and the actual access characteristic data that aredescriptive of the access characteristic on a copy as shown in FIG. 27.If the deviation of the predetermined access characteristic data and theactual characteristic data is above a threshold, then playback of the AVfiles might be prevented. Alternatively, playback quality might bedecreased.

On the other hand there may also be copy programs/copiers that aim atphysically copying a disc, i.e. not based on logical file names asexemplified in FIG. 27. In such a case, encryption parameters such ase.g. AACS parameters, will have to be copied as well. Since this islegally not possible since no copy programs or disc writer device existthat could e.g. copy the PMSN or volume ID of a BD-ROM, an illegalphysical copy cannot be played back. Thus, a copy program that operatesonly on the physical level, i.e. without checking the logical filesystem, will also not be able to make a copy of a record carrier asdepicted e.g. in FIG. 25.

FIG. 28 corresponds to FIG. 25, however, with arbitrary shuffled logicalfile names of the clips/areas 330-1, . . . , 330-4. This may lead tofurther confusion of a copier since no correlation between logical filenames and physical positions might be spotted.

The different file names of a same area may also be used to create fakeplaylists. For example, FIG. 29 shows four playlists PL10, PL20, PL30and PL40 for the areas 330-1, . . . , 330-4 (for illustrative purposesthese are the same areas as in FIGS. 25 and 28). The arrows in FIG. 29denoted with the respective reference signs PL10, PL20, PL30 and PL40indicate the sequence of logical file names that are included in therespective play lists. This results in:

-   -   PL10: clip#3, clip#8, clip#10, clip#7    -   PL20: clip#4, clip#12, clip#5, clip#8    -   PL30: clip#4, clip#11, clip#10, clip#1    -   PL40: clip#9, clip#5, clip#6, clip#7

The example of FIG. 29 has the same physical disc as FIG. 25 and samelogical file system (same names as in the example of FIG. 25), however,different playlists. As can be easily seen, playlists PL10 and PL40 are“correct” playlists that will access the physical areas in the correctorder, i.e. 330-1, 330-2, 330-3, and 330-4. Playlists PL20 and PL30,however, are “fake” playlists that will lead to a different access ofthe physical areas, and, thus, result in a wrong, i.e. userdissatisfying, reproduction. For example, when playlist PL20 is used forplayback, area 330-1 will be reproduced first, and then area 330-3 willbe reproduced three times.

Note that it is possible that the playlists have different length in thelogical file system and/or in the physical mapping. For example, aplaylist could comprise a different number of logical file names andlead to a reproduction of different length of audiovisual content byplaying back a different number of areas.

Similarly as before, see e.g. FIGS. 5, 12, 13, 17, and 18 andcorresponding description, the additional playlists could be used forconfusing a copier, wherein the correct playlist, e.g. playlist PL10 andPL40 in FIG. 28 can only be discriminated from the fake playlists if anoriginal disc check succeeds and/or correct “key data”, i.e. key data ascan only be read from an original disc, are extracted from the disc. Forexample, there may be stored a BD-J object on a Blu-ray disc that checksfor encryption parameters and/or the integrity of encryption parametersand determines the correct playlist, e.g. playlist 10 in FIG. 28, basedon the integrity check as explained above. Alternatively or additionallyencryption parameters such as e.g. PMSN, volume ID and/or the like couldbe used. Also, again a correct playlist may not be included on the discand provided for download from a server (cf. FIG. 9).

A copy without expected encryption parameters or with modified (sincehacked) encryption parameters may, therefore, be useless since theprogram instructions of the BD-J object will not lead to thediscrimination of the correct playlist from the fake playlists.

In a further embodiment it is also possible that the accesscharacteristic as explained above be used for discriminating correctfrom fake playlists. A playback device might e.g. in the example of FIG.29 check the access characteristic when accessing first clip#3 and thenclip#8. Only if the access characteristic would be in a predefined rangethat is expected to occur when the record carrier is a pre-recordedrecord carrier, then an algorithm might able to determine playlist PL I0 as correct playlist. In other words, the access characteristic may beused as input data for an algorithm for determining the correctplaylist. The input data might as above also be referred to as “keydata” or “key material”, i.e. a key that is calculated for the disc.

FIG. 30 shows a further embodiment combining the concept of slicing andshuffling explained above, e.g. at hand of FIGS. 1 to 4 and the conceptof using different logical file names for accessing the same physicalposition on a record carrier.

In FIG. 30, AV data 340 is sliced, i.e. divided, into six portions, i.e.AV portions, 342-1, . . . , 342-6. These AV portions, 342-1, . . . ,342-6 might have a length of e.g. one minute, one to two minutes and soon (for further values, see above). Moreover, the AV portions 342-1, . .. , 342-6 have a first order, wherein when the AV portions 342-1, . . ., 342-6 are reproduced in the first order, the content of AV data 340will be reproduced in the genuine playback sequence. As explained above,the AV portions 342 may then be shuffled or scrambled (mixed) so thatthe AV files 342-1, . . . , 342-6 have a second order that is an orderother than the first order. In the example of FIG. 30 the second orderis: 342-2, 342-6, 342-1, 342-3, 342-4, and 342-5.

The AV portions might then be written to the disc in the second order,i.e. the second order defines a physical position, e.g. an area or aplurality of areas on the disc where a AV portion will be stored.

Now, in accordance with the explanations of FIGS. 25 to 29, each of theAV files 342 could be accessed by a plurality of different logical filenames, for example, AV file 342-2 stored in a certain area or aplurality of certain areas on a disc might be accessed by logical filenames 11, 3 and 7. Similarly, AV file 342-6 may be accessed by logicalfile names 1, 4, and 8; AV-file 342-1 could be accessed by logical filenames 15, 2, and 10; AV-file 342-3 could be accessed by logical filenames 12, 16, and 18; AV file 342-4 could be accessed by logical filenames 5, 21, 9, 17, 13, 14, 19, 20; and AV file 342-5 could be accessedby a single logical file name 6.

The large number of logical file names gives the possibility of creatingan almost unlimited number of fake playlists (further first playlists).Also, a large number of correct playlists could be determined. Anexample for a correct playlist in FIG. 30 based on logical file names ise.g. 2, 11, 16, 21, 6, 8. An example for a fake playlist, also based onlogical file names, is e.g. 11, 4, 7, 20, 9.

Thus, the concept of using different logical file names for accessing asame AV file adds a “further dimension” to the number of playlists thatcould be determined without this concept.

Again, as before in order to determine the correct playlist, programinstructions stored on the disc might be used in combination withcharacteristic data extracted from the disc (“key data”).

Note that in the example of FIG. 30, in a further embodiment, the secondorder of the AV files 342 might not be completely arbitrary but suchthat a seamless playback is possible. In other words, the physicaldistance between two AV files 342 might not exceed a predefined distancein logical blocks. Such a constraint might be imposed by a standard forthe record carrier. For example, a physical distance in the Blu-rayformat may not exceed 640000 logical blocks.

Also, with respect to the embodiment of FIG. 30, it should be noted thatone file that is accessed by different logical file names may includeseveral sliced portions of the AV data 340. There is no limitation inthat each portion 342 be stored in one file as is the case in theexample of FIG. 30, though. However, a plurality of portions could alsobe stored in one file such as portions 108-3 and 108-2 are stored in onefile in FIG. 1.

In the above, a variety of different embodiments of methods, systems anddevices for copy protection as well as a variety of differentembodiments of record carriers has been described. Some of these methodsmay also be applied to copy protecting audiovisual content on harddiscs. For example the concept of slicing and shuffling AV clips couldalso be used to copy protect AV content on a hard disc. In any case, allof the described embodiments may be combined in any possible manner.

Thus, it should be understood that all of the embodiments describedabove may be combined in any way.

In the above, a number of times data is stored or written to a recordcarrier, such as e.g. files or clips (e.g. AV portions) or other datasuch as e.g. program instructions. This is done by modifying thephysical structure of a recording medium. For example, if the recordcarrier is a hard disk, magnetic properties of the respective recordingmedium will be altered/modified in order to store the data. If therecord carrier is an optical record carrier, e.g. optical disc, such ase.g. a DVD, BD and CD-ROM, pits and/or lands may be imposed onto therespective recording medium.

In some embodiments described above, the encryption characteristics ofthe AV data on the optical data carrier are analyzed. For this purposeprogram instructions are executed on playback devices. In the course ofthe execution of these instructions, the playback device retrieves thesecharacteristics of the encryption from the optical data carrier.Although the information is retrieved by the playback device, they arecharacteristics of the optical data carrier itself, not characteristicsof the playback device. Therefore, it is possible to detect situationswere AV data are stored on a data carrier that is not an original datacarrier.

Further, in some embodiments (see e.g. FIG. 1 but also many other Figs.)audiovisual data is stored in a plurality of portions, where allportions are in conformance with the format specification of the datacarrier. Due to the fact that each portion is in conformance with theformat specification, an appropriate playback device is able toreproduce each of these portions. Therefore the AV data are notconsidered to be corrupt. Storing of these portions in the second orderis done with the intention to make the AV data useless or of reducedenjoyment to an end user, if the first order is not known. If the data(portions) are played according to the second order or according tofurther first orders which are non-genuine playback orders (“fakeorders/playlists”) the entertainment value does not have the genuinequality, whereas the playback in the first order corresponds to thegenuine quality.

In order to better understand some of the technical contents, terms,abbreviations and so on, used throughout this specification, thefollowing documents may be helpful:

The entire contents of the document “Universal Disk Format™Specification”, Revision 2.50, Apr. 30, 2003, available from the website of the Optical Storage Technology Association (OSTA), www.osta.org,which is herewith incorporated by reference in its entirety.

Further, the entire contents of the document “White paper Blu-ray DiscFormat—2.B Audio Visual Application Format Specification for BD-ROM”,March 2005, available from the web site http://us.blu-raydisc.com, whichis herewith incorporated by reference in its entirety.

Further, the entire contents of the book “Blu-ray Disc Demystified”,1^(st) edition, Nov. 10, 2008, ISBN-13 978-0071590921 is herewithincorporated by reference in its entirety. Information about the bookcan also be found on the web site http://www.bddemystified.com.

Also, the entire contents of US 2008/0304811 A1 published on Dec. 11,2008 is herewith incorporated by reference in its entirety.

FIGS. 31A to 31C show a further embodiment where additional portions arestored on the record carrier. The additional portions could for exampleinclude information about copyright, advertisements for movies or otherproducts and/or information on how a legal copy of the record carriercould be obtained.

In this embodiment, the original playlist (first order) which allowsreproduction of the genuine content may not reference the additionalportions. However, fake playlists (further first orders) may referencethe additional portions. Some of the fake playlists may play at least apart of the audio visual content in the original genuine order such thata viewer would view at least a part of e.g. a movie or other content ingenuine quality. However, after a part of the movie has been played ingenuine quality (genuine order), the additional portion including e.g.information about the copyright or on how to obtain a legal copy wouldbe displayed. After that reproduction based on the fake playlist wouldstop or continue in non-genuine quality. Obviously it would be verydissatisfying for a viewer since the additional portion could be playedafter the viewer has gained an interest in the movie.

FIG. 31A shows an example where an additional portion 368-3 is insertedbetween portions 368-1 and 368-2. FIG. 31B shows an example of a fakeplaylist where play items 369-1, 369-2 and 369-3 respectively referenceportions 368-1, 368-3 and 368-2. Thus, in case the fake playlist is usedfor reproduction, the additional portion 368-3 will be reproduced.

FIG. 31C shows a further example where an additional portion 370-6 isadded and stored on the record carrier. As can be seen in the example ofFIG. 31C, the correct playlist PL-Correct does not include a play itemPI(370-6). On the other hand, the fake playlist PL-fake includes arespective play item PI(370-6).

Moreover, as can be seen in the example of FIG. 31C, the fake playlistPL-fake in the first part 371-1 corresponds to the first part 372-1 ofthe correct playlist PL-correct. Thus, when using the fake playlistPL-fake for reproduction, at the beginning the play items PI(370-1),PI(370-2), PI(370-3), PI(370-4) will be reproducing a part of thecontent in the genuine order (genuine quality). However, since a playitem referencing portion 370-5 is not included in the fake playlistPL-fake, portion 370-5 will not be reproduced when using the fakeplaylist PL-fake but instead a play item referencing portion 370-6.Assuming that the play item referencing portion 370-5 in the correctplaylist PL-Correct corresponds to the final scene of a movie, thiswould be very dissatisfying and annoying for a viewer when reproductionis with the fake playlist PL-fake.

FIG. 32A shows a further embodiment where an additional portion 375-3′is stored on the record carrier which is a copy of another portion 375-3stored on the record carrier. An advantage of this embodiment is that alarger number of fake playlists may be generated which fake playlistsare “in-spec”. In other words, all of the larger number of fakeplaylists may allow reproduction seamlessly, however, in a scrambledorder. In any case, a copier (hacker) could not distinguish the fakeplaylists from the correct playlist due to the fact that the fakeplaylist might not allow reproduction seamlessly. This is an advantagesince it adds a further level of security.

With regard to the meaning of the term “in-spec”, reference is made tothe above detailed description regarding details of the BD specificationaccording to which the maximum distance for two clips to be joinedseamlessly is (on a BD-ROM) 640000 logical blocks (intra-layer) and40000 logic blocks (inter-layer)

FIG. 32B shows an example illustrating this effect. On the recordcarrier of the example of FIG. 32B, portions of audio or audiovisualcontent 372-3, 372-6, 372-1, 372-5, 372-4, 372-2 and 372-6′ are storedin that order (second order). Portion 372-6′ is a copy of portion 372-6.

The correct playback sequence (first order) corresponds to the followingplayback sequence: 372-1, 372-2, 372-3, 372-4, 372-5, 372-6.

Thus, the correct playlist PL-Correct is given by:

PL-Correct={PI(372-1), PI(372-2), PI(372-3), PI(372-4), PI(372-5),PI(372-6)}

A fake playlist may be given as follows:

PL-Fake={PI(372-2), PI(372-6′), PI(372-4), PI(372-5), PI(372-1),PI(372-3)}.

As can be seen, the second play item PI(372-6′) in the fake playlistPL-Fake references the copy of the portion 372-6. Since the portion372-6′ is arranged very close (in example of FIG. 32B next to) portion372-2, reproduction when using the fake playlist PL-fake will beseamless. On the other hand, if the fake playlist PL-fake were toreference as a second play item the portion 372-6 (the original portionand not the copy 372-6′) then the distance between portion 372-2 andportion 372-6 would be very large and might be “out of spec”, i.e. noseamless reproduction would be possible for the following fake playlist:

PL-Fake={PI(372-2), PI(372-6), PI(372-4), PI(372-5), PI(372-1),PI(372-3)}.

The fact that this playlist would not allow a seamless reproductioncould be detected by a copier (hacker) and thereby the copier coulddetermine that this playlist is a fake playlist. Thus, by providing acopy as explained such a situation can be avoided and a larger number offake playlists can be generated which all allow seamless reproduction.This adds further enhances the copy protection since more fake playlistsmakes it more difficult to determine the correct playlist among thelarge number of fake playlists.

In a further embodiment (not shown) it would also be possible to haveseveral copies of one portion of audio visual content stored atdistributed physical locations on the record carrier.

The copy of one of the portions (or the plurality of copies in case ofmore than one copy) could be stored at various positions on the recordcarrier. Moreover, the portions of which copies are stored on the recordcarrier could be parts of a movie which are inconspicuous so that acopier (hacker) would not easily recognize that the content is notreproduced in the genuine order/quality when using a fake playlist asexplained.

FIG. 33 shows a further embodiment where an additional portion is storedon the record carrier corresponding to a copy of (only) a part ofanother portion. In the example of FIG. 33 reference sign 377-2represents a part of portion 377-3. As shown in the lower part of FIG.33, a copy 377-2′ of this part 377-2 is stored as additional portion onthe record carrier.

The effect of storing copies of parts of other portions is similar asdescribed above in connection with FIGS. 32A and 32B. Also in this casea larger number of playlists allowing seamless playback may be generatedsince the copies could be referenced in fake playlists.

FIGS. 34A and 34B show a further embodiment where additional portionsare generated and stored on the record carrier, the additional portionsincluding additional content such as e.g. advertisement and the like(see above) as well as copies of other portions stored on the recordcarrier. As seen in FIG. 34A, portion 382 includes portion 380-5 whichincludes additional contents as well as a first part 380-3-1 and asecond part 380-3-2 which respectively corresponds to parts of portion380-3.

It should be noted that in a possible further embodiment (not shown) itis not necessary that the additional portions be surrounded by copiedparts. It would be possible to only add copies before the additionalportions. Thus, in FIG. 34A, portion 382 could only include portion380-3-1 but not 380-3-2.

FIG. 34B shows an example of a fake playlist where the additionalportion shown in FIG. 34A is referenced by a play item 383-3 as thethird play item in the row of play items 383-1, 383-2, 383-3 and 383-4as a part of the fake playlist.

One effect is again similar as described above, i.e. a larger number offake playlists may be generated which allow seamless playback (in thewrong, i.e. non-genuine, order).

Another effect is that surrounding the additional portions with copiesof other portions makes it more difficult to spot the respectiveportions by copiers. For example, in case a respective clip (portion) ona BD disc would not start with a copy of a portion of genuine content, acopier could more easily spot the respective portion (including only theadditional portion e.g. comprising advertisement) since the copier mayeasily recognize, e.g. just be looking at the first picture of arespective video sequence, that the portion does not belong to thegenuine content stored on the disc. Moreover, in this case, the copier(hacker) could also exclude all (fake) playlists which reference therespective portion. This is prevented, if at least in the beginning of aportion, a copy of a portion of genuine content is added. The copierwill not be able to easily recognize that such a portion (e.g. portion382 in FIG. 34A) includes additional content. Moreover, since the copierdoes not recognize this, he will not be able to easily exclude (fake)playlists referencing such a portion.

FIG. 35A shows a further embodiment of a playlist having a first part393-1 and a second part 393-2, wherein a subpart of the second part393-2 is arranged before the first part 393-1 and a further subpart ofthe second part 393-2 is arranged after the first part 393-1.

In this embodiment, only the play items in the first part 393-1, i.e.play items 392-2, 392-3, 392-4 and 392-5, reference the portions ofaudio visual content such as to playback the genuine audio visualcontent as intended by the maker of the content.

In case all of the play items of the playlist, i.e. play items 392-1,392-2, 392-3, 392-4, 392-5, 392-6 and 392-7, are used for playback theplayback duration will be longer than intended by the maker of thecontent,

This will further be illustrated by means of an example:

Assume that the play items 392-2, 392-3, 392-4 and 392-5 correspond to acomplete movie in the genuine order. The movie might have a duration ofa first period which e.g. corresponds to two hours. However, since theplaylist comprises the additional play items 392-1, 392-6 and 392-7, theperiod of reproduction of the playlist could be much longer.

In the example of FIG. 35A only three additional play items 392-1, 392-6and 392-7 are shown. This should not be understood as any kind oflimitation since in fact a much larger number of additional play itemsis possible. In this case the reproduction time when using the fakeplaylist for reproduction could be much longer, e.g. more than 100,1000, 10.000 or even more hours.

Therefore, it would be very difficult for a copier (hacker) to determinewhich part of the playlist includes the play items which will (only)reproduce the content as intended by the maker of the content, e.g. thementioned two hours of the movie.

In order to hack the copy protection it would be necessary to watch themany hours of video sequences to determine when the movie actuallystarts and ends. In fact, it seems that a human could not hack such kindof copy protection.

In order to reproduce the record carrier of FIG. 35A, it will benecessary to find the correct start and end play item within the largenumber of play items in the playlist (in the example of FIG. 35A, playitems 392-2 and 392-5).

Based on the embodiment of FIG. 35A it would be possible to only includeone playlist (a “long” playlist) on the copy protected record carrier.For reproduction in genuine quality (here referring to reproduction ofthe content in the original length, i.e. as intended by the maker of thecontent) it will be necessary to determine the start and end play itemin the playlist. For this purpose the same possibilities as fordetermining a correct playlist among a large number of fake playlists asdescribed throughout this specification exist. For example, indexnumbers of the start and end play items could be assembled based onreading byte values at certain positions (cf. FIGS. 19A to 19J) or therespective index numbers could be downloaded from a server.

It would of course also be possible to include a large number of fake“long” playlists. Some or all of the fake playlists may lead toreproduction of several hundreds, thousands or more hours of content.Thus, for reproduction in genuine quality (with a genuine duration), itis necessary to determine the correct playlist (which may be a “long”playlist) and additionally to determine the start and end play itemswithin this playlist. Thus, copy protection can be further enhanced.

As indicated in the example of FIG. 35A the portions referenced by theplay items in the second part 393-2 may include additional content (seee.g. play item 392-1 referencing portion 390-5). Further, the play itemsin the second part 393-2 may also reference portions which are part ofthe genuine content (see e.g. play item 392-6 referencing portion390-3). Still further the play items in the second part 393-2 may alsoreference portions which are copies of other portions (see e.g. playitem 392-7 referencing portion 390-2′ which is a copy of portion 390-2).Thus, also in the “long” playlist seamless reproduction may be achievedsuch that a copier cannot get any clues as to where the start and endplay items are which allow reproduction in genuine quality/genuineduration.

FIG. 35B shows a further example of a record carrier where portions392-1 to 392-5 are stored on a record carrier in a scrambled order. Aplaylist which might be used for copy protection purposes is also shownin FIG. 35B. As seen, the playlist comprises a first part 394-1 whichallows reproduction of the audio visual content in the genuine orderwith genuine length (e.g. the genuine length of a movie). However, theplaylist PL further comprises a second part 394-2 which in the exampleof FIG. 35B is split up in sub parts as in FIG. 35A. The total length ofreproduction when using the playlist PL for playback might be manyhours, for example more than 10, 100, 1,000, 10,000 or even more hours.Thus, in order to playback only the portions 392-1, . . . , 392-5 in theoriginal order (first order) with the original duration it is necessaryto find the correct start and end play items in the playlist PL (in theexample these are play items PI(392-1) and PI(392-5) located in thefirst part 394-1).

FIG. 36 shows a further embodiment where a record carrier 400 whichcould e.g. be a Blu-Ray disc comprises a correct playlist and aplurality of fake playlist (further first orders). The correct playlistand the plurality of fake playlists each have an assigned index number.In the example of FIG. 36, the correct playlist has an assigned indexnumber 201 and the fake playlists have the indicated further indexnumbers 1 . . . 200 and 202 . . . 1000.

In order to playback the audiovisual content stored on the recordcarrier 400, the correct playlist has to be identified. This may be doneby a playback device 402 by checking whether carrier 400 is an original.If this is the case, a playback index number 403 is downloaded from aserver 404. Playback device 402 then matches the playback index number403 with the index numbers 1 . . . 1000 on the record carrier. Theplayback device 402 will then chose the respective playlist used forplayback based on the playback index number. For example, if the serverprovides as playback index number, the number “200”, a fake playlist(see table drawn on disc 400 in FIG. 36) will be used for playback.

In case the original disc check was successful, i.e. the record carrier400 has been identified to be an original, the server will provide theindex number for the correct playlist (in the example 201). Otherwise,download will either not start at all or the server may provide aplayback index number which will not enable the playback device todetermine the correct playback index, i.e. a fake playlist will be usedfor playback.

For determining the playback index number 403, the server may receivecertain predefined parameters from the original disc check performed atplayer 402 during playback of disc 400. For example, when the disc 400is played back, program instructions stored on the disc 400 may instructthe player to read certain hash values (cf. FIG. 15) or the like. Thesehash values (as an example of predefined parameters) may then be sentfrom the player 402 to the server 404. Based on these valued, the server404 may then determine the playback index number 403. For example, ifthe server 404 receives the “correct” (expected) hash values (e.g. thoseof an original disc) then the server may provide the playback indexnumber 403 such that the correct playlist is selected for playback, inthe example, this would be the index number 201 (see table on disc 400indicating that index number 200 has the correct playlist “Correct PL”associated).

Of course, as predefined parameters any other values/informationdisclosed throughout this specification could be used. For example, alsobyte values at predefined positions could be used and so on. Therefore,although this is indicated in FIG. 36, the player 402 need not perform afull “original disc check”. In fact it is sufficient to read certainpredefined parameters/values from the disc and send these parameters tothe server 404. In that sense, the server is involved in the originaldisc check since the server will compare the parameters/values sent fromthe playback device with expected values (those that are read in casethe disc is an original).

In a further embodiment (not shown in the Figs.) no original disc checkis performed at all and only e.g. a parameter identifying the title onthe disc is sent from the player to the server. The server may thendetermine the date on which the parameter is received and if the date isafter a predefined date, the server will provide a playback index numberfor the correct playlist. If the date is before the predefined date, theserver will either not provide a playback index number at all or aplayback index number referencing a fake playlist. This way it ispossible to prevent playback of a BD title before a desired releasedate.

FIG. 37 shows a further embodiment where a Blu-Ray disc 410 comprises afirst Java Class File 412. This first Java Class File 412, however,includes no instructions which would allow reproduction of the audio oraudiovisual content stored on the disc in genuine quality. For example,no program instructions may be included in the first Java Class File 412which would allow selection of a correct playlist among a large numberof fake playlists.

In order for the disc to playback the content in genuine quality (incase it is an original), a second Java Class File 414 is needed. Thismay be provided on a server 416 for download. However, a playback device417 may only be able to download the second Java Class File 414 in casean original disc check reveals that the disc 410 is an original disc.Otherwise, no download may be possible or alternatively the server maysupply a Java Class File which will lead to playback in non-genuinequality, e.g. by selecting a fake (e.g. advertising) playlist.

Based on a part of the above description, it is evident that someembodiments may be summarized by the following numbered items 1 to 115:

1. (canceled)
 2. A method for copy protection, comprising: providingaudiovisual data or audio data having a genuine playback sequencedefined by the content of the audiovisual data or audio data; dividingthe audiovisual data or audio data into a plurality of portions, theportions having a first order, wherein when the portions are reproducedin the first order the content is reproduced in the genuine playbacksequence; determining a second order for a subset of the portions, thesecond order being different than the first order; determining aphysical position where, on a record carrier, a respective portion ofthe plurality of portions is to be stored dependent on the second order;storing a plurality of further first orders on the record carrier, thefurther first orders being different from the first order; and storingprogram instructions on the record carrier, the program instructions,when executed on a reading device configured to playback the recordcarrier, extract characteristic parameters of the record carrier, thefirst order being discriminable from the further first orders based onthe characteristic parameters, wherein for a plurality of portions acopy of the respective portion is provided to be stored on the recordcarrier.
 3. The method of claim 2, wherein a first portion and a secondportion which follow each other consecutively in the first order andwhich are to be stored on the record carrier according to the secondorder will have a physical distance from each other on the recordcarrier, wherein the physical distance is not larger than an allowedphysical distance specified by a standard of the record carrier forportions to be reproduced seamlessly.
 4. The method of claim 2, whereinthe portions have a length in ranges of 10-20 seconds, 10-30 seconds, 30seconds to 1 minute, 1 minute to 2 or 3 minutes, 3 minutes to 5 minutes,and/or 5 to 10 minutes.
 5. The method of claim 2, wherein the firstorder is provided to be stored on the record carrier in an obfuscatedmanner.
 6. The method of claim 2, wherein the characteristic parametersare determined dynamically during playback of the content, and whereinthe characteristic parameters depend on the content.
 7. The method ofclaim 2, further comprising: providing at least one additional portionto be stored on the record carrier; including the additional portion inthe second order, such that when the portions are played back in one ofthe further first orders, the additional portion will be played back ata position according to the one of the further first orders, wherein theadditional portion is not included in the first order, such that theadditional portion is not reproduced when playing back the portions inthe first order.
 8. The method of claim 2, further comprising: providingat least one additional portion to be stored on the record carrier, theadditional portion being a copy of at least a part of one portion fromthe plurality of portions; including the additional portion in thesecond order, such that when the portions are played back in one of thefurther first orders, the additional portion will be played back at aposition according to the one of the further first orders.
 9. The methodof claim 2, further comprising: providing at least one additionalportion to be stored on the record carrier, the additional portioncomprising a copy of at least a part of one portion from the pluralityof portions and further comprising additional content; including theadditional portion in the second order, such that when the portions areplayed back in one of the further first orders, the additional portionwill be played back at a position according to the one of the furtherfirst orders.
 10. The method of claim 2, wherein at least a part of theportions are watermarked.
 11. The method of claim 2, wherein in thefirst order at least one portion is replaced by its copy, such that whenthe portions are reproduced in the first order, the copy will bereproduced, wherein the at least one portion which is replaced by itscopy is selected depending on a unique identifier of the record carrier.12. The method of claim 2, wherein at least one of the plurality ofportions is provided to be stored on a server and not so as to be storedon the record carrier.
 13. The method of claim 2, wherein datarepresenting the first order is provided on a server for download, andwherein the first order is not provided to be stored on the recordcarrier.
 14. The method of claim 2, wherein the beginning of at leastone of the portions corresponds to a beginning of a scene of thecontent, and/or the end of at least one of the portions corresponds toan end of a scene of the content.
 15. The method of claim 2, whereineach portion of the plurality of portions corresponds to a play itemincluded in a playback sequence used by a playback device for playingback the record carrier, wherein the playback sequence includes a firstpart referencing the play items in the first order and a second partreferencing at least a part of the play items, wherein when the playitems of the first part are used for playback audiovisual data or audiodata is reproduced for a first period, and wherein when the play itemsof the first and second parts are used for playback audiovisual data oraudio data is reproduced for a second period, wherein the first periodis shorter than the second period.
 16. The method of claim 15, whereinthe second part references additional play items corresponding toadditional portions to be stored on the record carrier.
 17. A method forreproducing content stored on a copy protected record carrier, therecord carrier comprising a plurality of portions stored thereon, asubset of the plurality of portions being stored in a second order, anda copy of a subset of the plurality of portions is stored being storedon the record carrier, the method comprising: determining a first orderfor the portions, the first order being different from the second order,wherein when the portions are reproduced in the first order the contentis reproduced in a genuine playback sequence and/or genuine quality;reproducing at least a part of the portions consecutively according tothe first order, the first order being determined from at least onecharacteristic parameter derived from the record carrier.
 18. A deviceadapted to reproduce content stored on a copy protected record carrier,the record carrier comprising portions stored thereon, a subset of theportions being stored in a second order, and a copy of a subset of theplurality of portions is stored being stored on the record carrier, thedevice comprising: a processor adapted to determine a first order forthe portions, the first order being different from the second order; adecoding unit adapted to reproduce at least a part of the portionsconsecutively according to the first order, the device further beingconfigured to extract characteristic parameters of the record carrier,wherein based on the characteristic parameters the processor isconfigured to discriminate the first order from the further firstorders.
 19. A system comprising: a device adapted to reproduce contentstored on a copy protected record carrier, the record carrier comprisingportions stored thereon, a subset of the portions being stored in ascrambled order, a copy of a subset of the plurality of portions isstored being stored on the record carrier, the device including aninterface adapted to receive via a network data representing a firstorder for the portions, the first order being different from the secondorder, and further including a decoding unit adapted to reproduce atleast a part of the portions consecutively according to the first order,the device being further configured to extract characteristic parametersof the record carrier, wherein based on the characteristic parameters aprocessor of the device is configured to discriminate the first orderfrom further first orders; and a server adapted to provide the firstorder for download by the device.
 20. A device adapted to manufacture acopy protected record carrier, comprising: a receiving unit adapted toreceive audiovisual data or audio data having a genuine playbacksequence defined by the content of the audiovisual data or audio data; adata processor adapted to divide the audiovisual data or audio data intoa plurality of portions, the portions having a first order, wherein whenthe portions are reproduced in the first order the content is reproducedin the genuine playback sequence and/or in a genuine quality, whereinthe processor is further adapted to determine a second order for asubset of the portions, the second order being different from the firstorder, and to provide a plurality of further first orders, and a copy ofa subset of the plurality of portions, the data processor further beingconfigured to determine program instructions on the record carrier, theprogram instructions, when executed on a reading device configured toplayback the record carrier, extract characteristic parameters of therecord carrier, the first order being discriminable from the furtherfirst orders based on the characteristic parameters; a writing unitadapted to write at least a part of the portions onto the record carrierin the second order, to store the further first orders and the programinstructions on the record carrier, and to store the copy of the subsetof the plurality of portions.
 21. A record carrier, comprising: genuineaudiovisual content or audio content stored in a plurality of portionson the record carrier, a subset of the plurality of portions beingstored in a scrambled order and a copy of a subset of the plurality ofportions stored on the record carrier, wherein when the subset ofportions is reproduced in the scrambled order, the genuine audiovisualcontent or genuine audio is not reproduced in its genuine playbacksequence; and program instructions executable on a playback device forthe record carrier, wherein the program instructions when executed bythe playback device cause the playback device to determine a first orderfor the portions, wherein when the portions are played back in the firstorder the genuine audiovisual or audio content is reproduced in itsgenuine playback sequence.
 22. A method for copy protection of AVcontent to be stored on a record carrier, comprising: dividing the AVcontent into a plurality of portions; determining an order for a subsetof the portions, when subset of the portions is reproduced in the orderat least a part of the AV content is reproduced in a manner that isdifferent to a genuine first order, and determining a subset of theplurality of portions to be stored as a copy; providing all of theportions so as to be stored on the record carrier, the subset of theportions being stored in the order; storing a plurality of further firstorders on the record carrier, the further first orders being differentfrom the first order; storing the copy of the subset of the plurality ofportions; and storing program instructions on the record carrier, theprogram instructions, when executed on a reading device configured toplayback the record carrier, extract characteristic parameters of therecord carrier, the first order being discriminable from the furtherfirst orders based on the characteristic parameters.